Update page 'OWASP test - Sloetjes'

2023-05-25 17:33:08 +02:00
parent 3cdec1b6d1
commit c32e5fd06d
1 changed files with 2 additions and 0 deletions
@@ -75,6 +75,8 @@
 > Peppers should be stored separately from the database, like in the application code or a separate configuration file. They should be securely managed and access should be limited only to trusted individuals. It's important that peppers are included in backups, but they should be stored separately from the data they protect to maintain their effectiveness.

 * Name 3 password hash functions considered to be secure at the time you answer this question, and appropriate parameters for each when used to store user credentials in a secure database. 
+
+
 > * bcrypt: You can use a cost factor of 10-12, which determines the computational cost of the hash.
 > * scrypt: Parameters include CPU/memory cost factor, block size, and parallelization factor. Recommended values might be N=16384, r=8, p=1.
 > * Argon2: Recommended parameters vary depending on the specific use-case and threat model. The OWASP password storage cheat sheet doesn't provide specific recommendations but does mention Argon2 as a good choice.