From c32e5fd06dadd7bc766855ca8b5e1f99167d3efa Mon Sep 17 00:00:00 2001 From: "xuanyi.wang" Date: Thu, 25 May 2023 17:33:08 +0200 Subject: [PATCH] Update page 'OWASP test - Sloetjes' --- OWASP test - Sloetjes.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/OWASP test - Sloetjes.md b/OWASP test - Sloetjes.md index 9614ca4..67070ff 100644 --- a/OWASP test - Sloetjes.md +++ b/OWASP test - Sloetjes.md @@ -75,6 +75,8 @@ > Peppers should be stored separately from the database, like in the application code or a separate configuration file. They should be securely managed and access should be limited only to trusted individuals. It's important that peppers are included in backups, but they should be stored separately from the data they protect to maintain their effectiveness. * Name 3 password hash functions considered to be secure at the time you answer this question, and appropriate parameters for each when used to store user credentials in a secure database. + + > * bcrypt: You can use a cost factor of 10-12, which determines the computational cost of the hash. > * scrypt: Parameters include CPU/memory cost factor, block size, and parallelization factor. Recommended values might be N=16384, r=8, p=1. > * Argon2: Recommended parameters vary depending on the specific use-case and threat model. The OWASP password storage cheat sheet doesn't provide specific recommendations but does mention Argon2 as a good choice.