Hashing and Hash-based Functions
V11.4.1
Verify that only approved hash functions are used for general cryptographic use cases, including digital signatures, HMAC, KDF, and random bit generation. Disallowed hash functions, such as MD5, must not be used for any cryptographic purpose.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 162, 20, 204, 216, 218, 220, 272, 31, 37, 39, 461, 473, 55, 594, 620, 68, 94, 97
V11.4.2
Verify that passwords are stored using an approved, computationally intensive, key derivation function (also known as a "password hashing function"), with parameter settings configured based on current guidance. The settings should balance security and performance to make brute-force attacks sufficiently challenging for the required level of security.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 20, 31, 37, 473, 55, 97
V11.4.3
Verify that hash functions used in digital signatures, as part of data authentication or data integrity are collision resistant and have appropriate bit-lengths. If collision resistance is required, the output length must be at least 256 bits. If only resistance to second pre-image attacks is required, the output length must be at least 128 bits.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 184, 20, 216, 218, 220, 272, 31, 37, 39, 438, 442, 473, 475, 523, 55, 594, 620, 68, 690, 75, 94, 97
V11.4.4
Verify that the application uses approved key derivation functions with key stretching parameters when deriving secret keys from passwords. The parameters in use must balance security and performance to prevent brute-force attacks from compromising the resulting cryptographic key.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 20, 31, 37, 473, 55, 97
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
