Weak KDF iterations (ARCH4116)

Key java.security.weak-kdf-iterations · Severity warning · Category security · CWE CWE-916

Using too few iterations or cost in a password derivation function, or a fast hash for password storage, weakens resistance to brute-force attacks.

Incorrect

PBEKeySpec spec = new PBEKeySpec(password, salt, 1000, 256);
SecretKeyFactory f = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
byte[] hash = f.generateSecret(spec).getEncoded();

Correct

PBEKeySpec spec = new PBEKeySpec(password, salt, 600_000, 256);
SecretKeyFactory f = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
byte[] hash = f.generateSecret(spec).getEncoded();

Fix

Use the current recommended high iteration count for PBKDF2, or move to a memory-hard KDF like Argon2, bcrypt, or scrypt.