Skip to content

Commit c3320a3

Browse files
redsun82hubwriter
andauthored
Apply suggestions from code review
Co-authored-by: hubwriter <hubwriter@github.com>
1 parent 776df33 commit c3320a3

File tree

1 file changed

+6
-12
lines changed

1 file changed

+6
-12
lines changed

swift/ql/src/queries/Security/CWE-328/WeakSensitiveDataHashing.qhelp

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,16 @@
1313
</p>
1414
<ul>
1515
<li>
16-
pre-image attacks: if you know a hash value <code>h(x)</code>,
16+
<b>Pre-image attacks</b>. If you know a hash value <code>h(x)</code>,
1717
you should not be able to easily find the input <code>x</code>.
1818
</li>
1919
<li>
20-
collision attacks: if you know a hash value <code>h(x)</code>,
20+
<b>Collision attacks</b>. If you know a hash value <code>h(x)</code>,
2121
you should not be able to easily find a different input
2222
<code>y</code>
2323
with the same hash value <code>h(x) = h(y)</code>.
2424
</li>
2525
</ul>
26-
<!--<p>
27-
In cases with a limited input space, such as for passwords, the hash
28-
function also needs to be computationally expensive to be resistant to
29-
brute-force attacks. Passwords should also have an unique salt applied
30-
before hashing, but that is not considered by this query.
31-
</p>-->
3226

3327
<p>
3428
As an example, both MD5 and SHA-1 are known to be vulnerable to collision attacks.
@@ -44,16 +38,16 @@
4438
<recommendation>
4539

4640
<p>
47-
Ensure that you use a strong, modern cryptographic hash function:
41+
Ensure that you use a strong, modern cryptographic hash function, such as:
4842
</p>
4943

5044
<ul>
5145
<li>
52-
such as Argon2, scrypt, bcrypt, or PBKDF2 for passwords and other data with limited input space where
46+
Argon2, scrypt, bcrypt, or PBKDF2 for passwords and other data with limited input space where
5347
a dictionary-like attack is feasible.
5448
</li>
5549
<li>
56-
such as SHA-2, or SHA-3 in other cases.
50+
SHA-2, or SHA-3 in other cases.
5751
</li>
5852
</ul>
5953

@@ -69,7 +63,7 @@
6963
<sample src="WeakSensitiveDataHashingBad.swift"/>
7064
<p>
7165

72-
Here is the same function using SHA-512 that is a strong cryptographic hashing function.
66+
Here is the same function using SHA-512, which is a strong cryptographic hashing function.
7367
</p>
7468
<sample src="WeakSensitiveDataHashingGood.swift"/>
7569

0 commit comments

Comments
 (0)