rspec/rules/S2053/java/rule.adoc

include::../description.adoc[]

include::../recommended.adoc[]

== Noncompliant Code Example

Below, the hashed password use a predictable salt:

----
byte[] salt = "notrandom".getBytes();

PBEParameterSpec cipherSpec = new PBEParameterSpec(salt, 10000); // Noncompliant, predictable salt
PBEKeySpec spec = new PBEKeySpec(chars, salt, 10000, 256); // Noncompliant, predictable salt
----

== Compliant Solution

Use ``++java.security.SecureRandom++`` to generate an unpredictable salt:

----
SecureRandom random = new SecureRandom();
byte[] salt = new byte[16];
random.nextBytes(salt);

PBEParameterSpec cipherSpec = new PBEParameterSpec(salt, 10000); // Compliant
PBEKeySpec spec = new PBEKeySpec(chars, salt, 10000, 256); // Compliant
----

include::../see.adoc[]