Rule Definition
An iteration count has traditionally served the purpose of increasing the cost of producing keys from a password,
thereby also increasing the difficulty of attack. According to PKCS #5: Password-Based Cryptography Specification,
Version 2.0, a minimum of 1000 iterations is recommended. This will increase the cost of exhaustive search for passwords significantly,
without a noticeable impact in the cost of deriving individual keys.
Remediation
According to PKCS #5: Password-Based Cryptography Specification, Version 2.0, a minimum of 1000 iterations is recommended.
Violation Code Sample
int iterationCount = 10;
PBEParameterSpec pbeps = new PBEParameterSpec(salt, iterationCount);
Fixed Code Sample
An iteration count is greater or equal to 1000
Reference
https://cwe.mitre.org/data/definitions/916.html
https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure
https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure
Related Technologies
Technical Criterion
Secure Coding - Weak Security Features
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.