Do not use a predictable salt

문서 > Datadog 보안 > Code Security > Static Code Analysis (SAST) > SAST Rules > Do not use a predictable salt

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

ID: csharp-security/no-predictable-salt

Language: C#

Severity: Error

Category: Security

CWE: 760

Description

A salt to hash a password should always be different for each user. Otherwise, it becomes an attack vector. As mentioned on Wikipedia “The way salting is typically done is that a new salt is randomly generated for each password”.

Learn More

Non-Compliant Code Examples

using System.Security.Cryptography;

class MyClass {
    public static void createHashedPassword1(password)
    {
        var salt = Encoding.UTF8.GetBytes("myuniquesalt");
        return new Rfc2898DeriveBytes(password, salt);
    }

    public static void createHashedPassword2(password)
    {
        return new Rfc2898DeriveBytes(password, Encoding.UTF8.GetBytes("myuniquesalt"));
    }

    public static void createHashedPassword3(password)
    {
        return new Rfc2898DeriveBytes(password, GetBytes("myuniquesalt"));
    }
}

Compliant Code Examples

using System.Security.Cryptography;

class MyClass {
    public static void createHashedPassword(password)
    {
        return new Rfc2898DeriveBytes(password, 32);
    }
}