← 返回首页
Use of an inappropriate cryptographic hashing algorithm on passwords — CodeQL query help documentation CodeQL docs
CodeQL documentation
CodeQL resources

Use of an inappropriate cryptographic hashing algorithm on passwords

ID: swift/weak-password-hashing Kind: path-problem Security severity: 7.5 Severity: warning Precision: high Tags: - security - external/cwe/cwe-327 - external/cwe/cwe-328 - external/cwe/cwe-916 Query suites: - swift-code-scanning.qls - swift-security-extended.qls - swift-security-and-quality.qls

Click to see the query in the CodeQL repository

Hash functions that are not sufficiently computationally hard can leave data vulnerable. You should not use such functions for password hashing.

A strong cryptographic hash function should be resistant to:

Password hashing algorithms should be slow and/or memory intensive to compute, to make brute force attacks more difficult.

Recommendation

For password storage, you should use a sufficiently computationally hard cryptographic hash function, such as one of the following:

Example

The following examples show two versions of the same function. In both cases, a password is hashed using a cryptographic hashing algorithm. In the first case, the SHA-512 hashing algorithm is used. It is vulnerable to offline brute force attacks:

let passwordData = Data(passwordString.utf8) let passwordHash = Crypto.SHA512.hash(data: passwordData) // BAD: SHA-512 is not suitable for password hashing. // ... if Crypto.SHA512.hash(data: Data(passwordString.utf8)) == passwordHash { // ... }

Here is the same function using Argon2, which is suitable for password hashing:

import Argon2Swift let salt = Salt.newSalt() let result = try! Argon2Swift.hashPasswordString(password: passwordString, salt: salt) // GOOD: Argon2 is suitable for password hashing. let passwordHash = result.encodedString() // ... if try! Argon2Swift.verifyHashString(password: passwordString, hash: passwordHash) { // ... }

References