32 lines
878 B
Plaintext
32 lines
878 B
Plaintext
include::../description.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Noncompliant Code Example
|
|
|
|
----
|
|
public void Hash(string password)
|
|
{
|
|
var salt = Encoding.UTF8.GetBytes("Hardcoded salt");
|
|
var fromHardcoded = new Rfc2898DeriveBytes(password, salt); // Noncompliant, salt is hardcoded
|
|
|
|
salt = Encoding.UTF8.GetBytes(password);
|
|
var fromPassword = new Rfc2898DeriveBytes(password, salt); // Noncompliant, password should not be used as a salt as it makes it predictable
|
|
|
|
var shortSalt = new byte[8];
|
|
RandomNumberGenerator.Create().GetBytes(shortSalt);
|
|
var fromShort = new Rfc2898DeriveBytes(password, shortSalt); // Noncompliant, salt is too short (should be at least 16 bytes, not 8)
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
----
|
|
public DeriveBytes Hash(string password)
|
|
{
|
|
return new Rfc2898DeriveBytes(password, 16);
|
|
}
|
|
----
|
|
|
|
include::../see.adoc[]
|