Rule Definition
Using insecure parameters for this encoder could expose users to brute-force and other types of attacks.

Remediation
Always use recommended parameters.

Violation Code Sample

final int saltLengthKO1 = 15;
final int hashLengthKO1 = 15;
final int memoryKO1 = 512;
final int iterationsKO1 = 2;
Argon2PasswordEncoder pe = new Argon2PasswordEncoder(saltLengthKO1, hashLengthKO1, 1, memoryKO1, iterationsKO1); // insecure parameters

Fixed Code Sample

Argon2PasswordEncoder pe = new Argon2PasswordEncoder(); // OK

// Other solution:
final int saltLengthOK1 = 16;
final int hashLengthOK1 = 16;
final int memoryOK1 = 1024;
final int iterationsOK1 = 3;
Argon2PasswordEncoder pe = new Argon2PasswordEncoder(saltLengthOK1, hashLengthOK1, 1, memoryOK1, iterationsOK1); // OK

CWE-916: Use of Password Hash With Insufficient Computational Effort https://cwe.mitre.org/data/definitions/916.html CWE-522: Insufficiently Protected Credentials https://cwe.mitre.org/data/definitions/522.html