RShah257892 (Community Member) asked a question.
CWE 916 : Use of Password Hash With Insufficient Computational Effort : What is the recommendation based on the algorithm used for the iteration count?
Is there any recommendation on what the iteration count should be based on the algorithm used?
For example, PBEKeySpec is created using algorithm PBKDF2WithHmacSHA512 and iteration count of 65536.
.png){kind=logo}
Hi @RShah257892 (Community Member),
I recommend taking a look at OWASP's Password Storage cheat sheet. The section on PBKDF2 suggests iteration counts based on the hashing algorithm you are using.
Kind regards,
Duncan