Weak PBKDF2 iterations (ARCH332)

Key dotnet.security.weak-pbkdf2-iterations · Severity warning · Category security · CWE CWE-916

Using a low iteration count for PBKDF2 reduces the computational cost of the derived key, making it easier for attackers to crack passwords with brute-force or dictionary attacks.

Incorrect

var hash = new Rfc2898DeriveBytes(
    password, salt, 1000, HashAlgorithmName.SHA1).GetBytes(32);

Correct

var hash = new Rfc2898DeriveBytes(
    password, salt, 100_000, HashAlgorithmName.SHA256).GetBytes(32);

Fix

Use at least 100,000 iterations and SHA-256 for PBKDF2, and raise the iteration count periodically as hardware improves.