From 96051b15ba88beabeecdaad2f4951bcc14ddac76 Mon Sep 17 00:00:00 2001 From: "xuanyi.wang" Date: Thu, 25 May 2023 17:21:41 +0200 Subject: [PATCH] Update page 'OWASP test - Sloetjes' --- OWASP test - Sloetjes.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/OWASP test - Sloetjes.md b/OWASP test - Sloetjes.md index 63fe41f..4a3b5f9 100644 --- a/OWASP test - Sloetjes.md +++ b/OWASP test - Sloetjes.md @@ -67,11 +67,10 @@ * Describe how to store and manage a cryptographic pepper in the context of multiple web servers sharing the same database, and backups. You may assume the web servers and backups are managed by trusted personnel. > Peppers should be stored separately from the database, like in the application code or a separate configuration file. They should be securely managed and access should be limited only to trusted individuals. It's important that peppers are included in backups, but they should be stored separately from the data they protect to maintain their effectiveness. -* Name 3 password hash functions considered to be secure at the time you answer this question, and appropriate parameters for each when used to store user credentials in a secure database. -> As of my knowledge cutoff in September 2021, bcrypt, scrypt, and Argon2 are considered secure password hash functions. - > bcrypt: You can use a cost factor of 10-12, which determines the computational cost of the hash. - > scrypt: Parameters include CPU/memory cost factor, block size, and parallelization factor. Recommended values might be N=16384, r=8, p=1. - > Argon2: Recommended parameters vary depending on the specific use-case and threat model. The OWASP password storage cheat sheet doesn't provide specific recommendations but does mention Argon2 as a good choice. +* Name 3 password hash functions considered to be secure at the time you answer this question, and appropriate parameters for each when used to store user credentials in a secure database. +> bcrypt: You can use a cost factor of 10-12, which determines the computational cost of the hash. +> scrypt: Parameters include CPU/memory cost factor, block size, and parallelization factor. Recommended values might be N=16384, r=8, p=1. +> Argon2: Recommended parameters vary depending on the specific use-case and threat model. The OWASP password storage cheat sheet doesn't provide specific recommendations but does mention Argon2 as a good choice. * Describe the circumstances under which a properly managed credential storage system would allow a system administrator to recover the unencrypted/unhashed credentials with an offline copy of the credential store. > In a properly managed credential storage system, it should not be possible to recover the original plaintext passwords from the stored hashed values, even if you have an offline copy of the credential store. If a system allows for this, it's a sign of poor security practices.