You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "Dhaval Shah (Jira)" <ji...@apache.org> on 2021/02/08 13:36:00 UTC
[jira] [Assigned] (RANGER-3173) PBEParameterSpec has < 1000
iteration
[ https://issues.apache.org/jira/browse/RANGER-3173?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Dhaval Shah reassigned RANGER-3173:
-----------------------------------
Assignee: Dhaval Shah
> PBEParameterSpec has < 1000 iteration
> -------------------------------------
>
> Key: RANGER-3173
> URL: https://issues.apache.org/jira/browse/RANGER-3173
> Project: Ranger
> Issue Type: Improvement
> Components: Ranger
> Reporter: Md Mahir Asef Kabir
> Assignee: Dhaval Shah
> Priority: Major
>
> In file [https://github.com/apache/ranger/blob/71e1dd40366c8eb8e9c498b0b5158d85d603af02/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java] (at Line 311) PBEParameterSpec has been initialized with < 1000 iteration count.
> *Security Impact*:
> < 1000 iteration count makes it vulnerable to dictionary attack
> *Useful resource*:
> https://cryptosense.com/blog/parameter-choice-for-pbkdf2
> *Solution we suggest*:
> Iteration count should be at least 1000
> *Please share with us your opinions/comments if there is any*:
> Is the bug report helpful?
--
This message was sent by Atlassian Jira
(v8.3.4#803005)