OWASPASVS 5.0 requirement
ASVS-V11.4.4 The application uses approved key derivation functions with key stretching parameters when deriving secret keys from passwords.
- Standard
- OWASP ASVS 5.0
- Chapter
- V11 Cryptography
- Section
- V11.4 Hashing and Hash-based Functions
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the application uses approved key derivation functions with key stretching parameters when deriving secret keys from passwords. The parameters in use must balance security and performance to prevent brute-force attacks from compromising the resulting cryptographic key.