You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@cordova.apache.org by "Sahil (JIRA)" <ji...@apache.org> on 2017/02/10 15:04:41 UTC

[jira] [Created] (CB-12447) Inadequate Encryption Strength

Sahil created CB-12447:
--------------------------

             Summary: Inadequate Encryption Strength
                 Key: CB-12447
                 URL: https://issues.apache.org/jira/browse/CB-12447
             Project: Apache Cordova
          Issue Type: Bug
            Reporter: Sahil


We are using Cordova for our android hybrid app and following is the result for the VARACODE static scan 	

Attack Vector: javax.crypto.spec.PBEKeySpec.!operator_javanewinit

Description: This call to javax.crypto.spec.PBEKeySpec.!operator_javanewinit() uses fewer than 1000 iterations for PBE key generation. RFC 2898 recommends at least 1000 iterations because a higher iteration count increases the computational cost of a dictionary attack.

Remediation: Use a minimum of 1000 iterations.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org