PDoshi717791 (Community Member) asked a question.
Hello People,I am using SHA-256 for cryptographic security. When checkmarx scans the code, it gives below error.
"Use of a One Way Hash without a Salt"
"Use of a One Way Hash without a Salt"
I am using below code:
private static final String SALT = "hey neat, salt!";
MessageDigest md = MessageDigest.getInstance("SHA-256");
String forHashing = aDestination + SALT;
byte[] computedHash = md.digest(forHashing.getBytes());
String hash = encode(computedHash);
Any suggestions on what can be done to resolve this error ?
Thanks !
.png){kind=logo}
HI @PDoshi717791 (Community Member) ,
While, as a Veracode Application Security Consultant, it is impossible for me to speak to the detection capabilities of Checkmarx Static Analysis the example given above appears to be using a static value which is defeats much of the purpose of adding a salt (for more information: https://en.wikipedia.org/wiki/Salt_(cryptography)#Salt_re-use ). I would recommend at least using SecureRandom to generate a random value, you can find an example of this here: https://www.baeldung.com/java-password-hashing .
Note that for passwords we would not recommend using SHA-256 but rather more dedicated algorithms like the ones specified here: https://www.veracode.com/blog/research/password-storage-using-java .
Thank you,
Boy Baukema