OWASPASVS 5.0 requirement
ASVS-V11.4.2 Passwords are stored using an approved, computationally intensive, key derivation function (also known as a "password hashing function"),…
- Standard
- OWASP ASVS 5.0
- Chapter
- V11 Cryptography
- Section
- V11.4 Hashing and Hash-based Functions
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that passwords are stored using an approved, computationally intensive, key derivation function (also known as a "password hashing function"), with parameter settings configured based on current guidance. The settings should balance security and performance to make brute-force attacks sufficiently challenging for the required level of security.