RRoy Moulick393155 (Community Member) asked a question.
How to fix CWE 760 use of a one-way hash with a predictable salt in java?
I have the following code where veracode is throwing CWE 760-
bytearray salt = new bytearray[16];
SecureRandom sr = new SecureRandom();
sr.nextBytes(salt);
java.security.spec.KeySpec sc = new javax.crypto.spec.PBEKeySpec(mypwd.tocharArray(), salt, iterationcounts, keylength); // here veracode is throwing CWE 760
I am using keylength of 256 bytes and iteration counts value 150000.
I can't understand how to remediate this issue. Please advise what needs to be done in my code to clean veracode without hampering the existing functionality.
Could anybody please send me some java solutions for this flaw?
Regards,
Ritesh
.png){kind=logo}
Hi @RRoy Moulick393155 (Community Member) ,
I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Thank you,
Boy Baukema