Weak KDF Iterations (ARCH5116)

Key go.security.weak-kdf-iterations · Severity warning · Category security · CWE CWE-916

Using a password KDF with too few iterations, or storing passwords with a fast hash, weakens resistance to brute-force attacks.

Incorrect

func hashPassword(pw, salt []byte) []byte {
  return pbkdf2.Key(pw, salt, 1000, 32, sha256.New) // too low
}

Correct

func hashPassword(pw, salt []byte) []byte {
  return pbkdf2.Key(pw, salt, 600_000, 32, sha256.New)
}

Fix

Use a high iteration count for PBKDF2 (OWASP: 600,000+ with SHA-256) or prefer a KDF like bcrypt/scrypt/argon2.