dotnet / dotnet/dotnet-api-docs

Default hash and iteration count not mentioned the constructors of Rfc2898DeriveBytes Constructors

Open
#7,829 3 comments 0 reactions 0 assignees View on GitHub
area-System.Security help wanted Pri3
Dominant language
C#
Stars
949
Forks
1.7k
Avg merge
3d 27m
Merged PRs (30d)
49

Description

Currently the default hash algorithm (SHA-1) and iteration count (1000) are not mentioned. It is also not mentioned that requesting more bytes from Rfc2898DeriveBytes than the output size of the selected hash algorithm will have adverse affects on the performance of this algorithm as it will perform all the iterations again, while the adversary may not require those. There is also a slight bug that mentions in the exception that an iteration count < 1 will generate an error, even though the constructor doesn't have the iteration count as parameter. In short: please mention the defaults on top of the constructor description.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.