DerScanner
Home / Vulnerability Database / PHP : Insufficient number of iterations
PHP

PHP : Insufficient number of iterations

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure Design
OWASP MASVS
V3: 3.3.(L1/L2/L1+R/L2+R)V8: 8.13.(L1+R/L2+R)
OWASP ASVS
Stored CryptographyStored CryptographyAuthenticationAuthenticationAuthenticationAuthenticationAuthenticationAuthentication
PCI DSS 4.0
3.6.16.2.48.3.2
HIPAA
§164.312 (a)(2)(iv)
CWE
CWE-326CWE-1032

Overview

The password-based key derivation function uses too few iterations.

The key derivation function (KDF) generates one or more secret keys based on a secret value (master key, password or passphrase) using a pseudorandom function. Salt values ​​and a number of iterations are also used as parameters. A sufficient number of iterations provides the necessary stability of the algorithm. If the number of iterations is low, the possibility of attack increases, because an attacker can use “rainbow tables” to reverse the initial values ​​of hashed passwords.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2013-A6-Sensitive Data Exposure
  2. PHP: hash_pbkdf2
  3. CWE-916: Use of Password Hash With Insufficient Computational Effort
  4. OWASP Top 10 2017-A3-Sensitive Data Exposure
  5. CWE-326: Inadequate Encryption Strength
  6. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
  7. Bleichenbacher’s attack
MEDIUM

DerScanner Severity Score

Do you want to fix PHP : Insufficient number of iterations in your application?

See also

PHP

PHP : Null salt

PHP

PHP : Empty password

PHP

PHP : Empty salt