Rule Definition
Using insecure parameters for this encoder could expose users to brute-force and other types of attacks.

Remediation
Always use recommended parameters.

Violation Code Sample

final int cpuCostKO1 = 8192;
final int memoryCostKO1 = 7;
final int keyLengthKO1 = 16;
final int saltLengthKO1 = 32;
SCryptPasswordEncoder pe = new SCryptPasswordEncoder(cpuCostKO1, memoryCostKO1, 1, keyLengthKO1, saltLengthKO1); // insecure parameters

Fixed Code Sample

SCryptPasswordEncoder pe = new SCryptPasswordEncoder(); // OK

// Other solution:
final int cpuCostOK1 = 16384;
final int memoryCostOK1 = 8;
final int keyLengthOK1 = 32;
final int saltLengthOK1 = 64;
SCryptPasswordEncoder se2 = new SCryptPasswordEncoder(cpuCostOK1, memoryCostOK1, 1, keyLengthOK1, saltLengthOK1); // OK

CWE-916: Use of Password Hash With Insufficient Computational Effort https://cwe.mitre.org/data/definitions/916.html CWE-522: Insufficiently Protected Credentials https://cwe.mitre.org/data/definitions/522.html