fix/cci upload rename#147
Conversation
Signed-off-by: Mark Rivera <mcrivera@gmail.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| export function hashPassword(password: string, salt: string, secretKey: string): string { | ||
| const hmac = crypto.createHmac("sha256", secretKey); | ||
| hmac.update(password); |
Check failure
Code scanning / CodeQL
Use of password hash with insufficient computational effort
There was a problem hiding this comment.
I think CodeQL may be indavertantly flagging on hmac.update.
hmac.upadate(password) is an intermediate step, not the final hash.
We are HMAC-ing the password with a secretKey using SHA-256 (not a weak hash like MD5 or SHA-1 stated in the Show more details).
We are feeding the result into PBKDF2, recommended by NIST and OWASP and has FIPS-140 validated implementations,.
We are using 600000 iterations which exceeds NIST requirements (>10,000) and is the recommended # of iterations by OWASP when using PBKDF2-HMAC-SHA256.
Signed-off-by: Mark Rivera <mcrivera@gmail.com>
|
3 participants
No longer uses system defined temp dir to upload CCI matrix to. Now uploads directly to configured dir.