Cryptographic Storage Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:07:14Z

Point to the official site

Thunder-Son: Migration to GitHub

2019-02-14T11:00:32Z

Migration to GitHub

Show changes

Peter Mosmans: Add Argon2 as recommended algorithm

2018-06-19T01:34:25Z

Add Argon2 as recommended algorithm

Peter Mosmans: Add Argon2 as recommended algorithm

2018-06-13T09:42:21Z

Add Argon2 as recommended algorithm

Jmanico: /* Other Cheatsheets */

2017-09-11T06:01:11Z

‎Other Cheatsheets

Pawel Krawczyk: /* Rule - Use strong random numbers */ what to use instead for C and Java

2017-05-17T10:44:34Z

‎Rule - Use strong random numbers: what to use instead for C and Java

Tony Hsu HsiangChih: /* Related Articles */

2017-03-06T02:26:27Z

‎Related Articles

Tony Hsu HsiangChih: /* Authors and Primary Editors */

2017-03-06T02:25:39Z

‎Authors and Primary Editors

Tony Hsu HsiangChih: /* Related Articles */

2017-03-06T02:22:20Z

‎Related Articles

Tony Hsu HsiangChih: /* Architectural Decision */

2017-03-06T02:07:07Z

‎Architectural Decision

← Older revision		Revision as of 14:07, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/Cryptographic_Storage_Cheat_Sheet.md Cryptographic Storage Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html Cryptographic Storage Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 46: / Line 46: @@
 Do not implement an existing cryptographic algorithm on your own, no matter how easy it appears. Instead, use widely accepted algorithms and widely accepted implementations.
-Only use approved public algorithms such as AES, RSA public key cryptography, and SHA-256 or better for hashing. Do not use weak algorithms, such as MD5 or SHA1. Avoid hashing for password storage, instead use PBKDF2, bcrypt or scrypt. Note that the classification of a "strong" cryptographic algorithm can change over time. See [http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf NIST approved algorithms] or ISO TR 14742 “Recommendations on Cryptographic Algorithms and their use” or [http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-size-and-parameters-report-2014/at_download/fullReport Algorithms, key size and parameters report – 2014] from European Union Agency for Network and Information Security.
+Only use approved public algorithms such as AES, RSA public key cryptography, and SHA-256 or better for hashing. Do not use weak algorithms, such as MD5 or SHA1. Avoid hashing for password storage, instead use Argon2, PBKDF2, bcrypt or scrypt. Note that the classification of a "strong" cryptographic algorithm can change over time. See [http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf NIST approved algorithms] or ISO TR 14742 “Recommendations on Cryptographic Algorithms and their use” or [http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-size-and-parameters-report-2014/at_download/fullReport Algorithms, key size and parameters report – 2014] from European Union Agency for Network and Information Security.
 E.g. [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] 128, [http://en.wikipedia.org/wiki/RSA_(cryptosystem) RSA] 3072, [http://en.wikipedia.org/wiki/Secure_Hash_Algorithm SHA] 256.

@@ Line 21: / Line 21: @@
 * Assymetric encryption: RSA 2048 bits
 * Symmetric-key algorithm: AES 128 bits
-* Password Hashing: PBKDF2, Scrypt, Bcrypt.
+* Password Hashing: Argon2, PBKDF2, Scrypt, Bcrypt.
 = Providing Cryptographic Functionality  =

@@ Line 222: / Line 222: @@
 Tony Hsu - hsiang_chih[at]yahoo.com
-== Other Cheatsheets ==
+= Other Cheatsheets =
 {{Cheatsheet_Navigation_Body}}

@@ Line 72: / Line 72: @@
 Tools like [http://csrc.nist.gov/groups/ST/toolkit/rng/documentation_software.html NIST RNG Test tool] (as used in PCI PTS Derived Test Requirements) can be used to comprehensively assess the quality of a Random Number Generator by reading e.g. 128MB of data from the RNG source and then assessing its randomness properties with the tool.
-The following libraries are considered weak random numbers generator and should not be used.
+The following libraries are considered '''weak''' random numbers generators and should not be used.
-* C library : random()、rand();
+* C library: <code>random()</code>, <code>rand()</code>  — use [http://man7.org/linux/man-pages/man2/getrandom.2.html getrandom(2)] instead
-* Java library : java.util.Random()
+* Java library: <code>java.util.Random()</code>  — use <code>java.security.SecureRandom</code> instead
 For secure random number generation, refer to NIST SP 800-90A. CTR-DRBG、HASH-DRBG、HMAC-DRBG are recommended.

@@ Line 210: / Line 210: @@
 OWASP – [http://www.owasp.org/index.php/ASVS Application Security Verification Standard (ASVS) – Communication Security Verification Requirements (V10)]
 ssllabs Wiki - https://github.com/ssllabs/research/wiki
 = Authors and Primary Editors  =

@@ Line 217: / Line 217: @@
 Kevin Wall - kevin.w.wall[at]gmail.com<br/>
 Jim Manico - jim[at]owasp.org<br/>
-Fred Donovan - fred.donovan(at)owasp.org
+Fred Donovan - fred.donovan(at)owasp.org <br/>
 == Other Cheatsheets ==

← Older revision		Revision as of 02:22, 6 March 2017
Line 209:		Line 209:

	OWASP – [http://www.owasp.org/index.php/ASVS Application Security Verification Standard (ASVS) – Communication Security Verification Requirements (V10)]		OWASP – [http://www.owasp.org/index.php/ASVS Application Security Verification Standard (ASVS) – Communication Security Verification Requirements (V10)]
		+	ssllabs Wiki - https://github.com/ssllabs/research/wiki

	= Authors and Primary Editors =		= Authors and Primary Editors =

@@ Line 17: / Line 17: @@
 * Key exchange: Diffie–Hellman key exchange with minimum 2048 bits
-** Message Integrity: HMAC-SHA2
+* Message Integrity: HMAC-SHA2
-** Message Hash: SHA2 256 bits
+* Message Hash: SHA2 256 bits
-** Assymetric encryption: RSA 2048 bits
+* Assymetric encryption: RSA 2048 bits
-** Symmetric-key algorithm: AES 128 bits
+* Symmetric-key algorithm: AES 128 bits
-** Password Hashing: PBKDF2, Scrypt, Bcrypt.
+* Password Hashing: PBKDF2, Scrypt, Bcrypt.
 = Providing Cryptographic Functionality  =