Class Pbkdf2Defaults

java.lang.Object

com.svenruppert.jsentinel.credential.password.pbkdf2.Pbkdf2Defaults

public final class Pbkdf2Defaults
extends Object

Phase-1a reference parameters for the PBKDF2 password hashing path.

The defaults follow the OWASP 2023 guidance for PBKDF2-HMAC-SHA256: 600 000 iterations, 16 random bytes of salt and a 32-byte derived key. The upper bounds are deliberately generous so that operators can ramp iterations over time, but small enough to keep a single verification under one second on commodity hardware (CWE-400).

Field Summary

Fields

Modifier and Type	Field	Description
static final int	DEFAULT_ITERATIONS	Phase-1a default iteration count.
static final int	DEFAULT_KEY_LENGTH	Phase-1a default derived-key length in bytes.
static final int	DEFAULT_SALT_LENGTH	Phase-1a default salt length in bytes.
static final int	MAX_ITERATIONS	Maximum iteration count accepted by the validator.
static final int	MAX_KEY_LENGTH	Maximum derived-key length in bytes.
static final int	MAX_SALT_LENGTH	Maximum salt length in bytes.
static final int	MIN_ITERATIONS	Minimum acceptable iteration count for stored hashes.
static final int	MIN_KEY_LENGTH	Minimum derived-key length in bytes.
static final int	MIN_SALT_LENGTH	Minimum salt length in bytes.

Method Summary

Modifier and Type	Method	Description
static Map<String,String>	defaultParameters()	Default parameter map for new PBKDF2 envelopes.
static Map<String,String>	maximumParameters()	Maximum-bound parameter map.
static Map<String,String>	minimumParameters()	Minimum-bound parameter map.
static PasswordHashPolicy	referencePolicy()	Convenience: build a single-algorithm reference policy that emits PBKDF2 envelopes with the Phase-1a defaults.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_ITERATIONS

public static final int DEFAULT_ITERATIONS

Phase-1a default iteration count.

See Also:

• Constant Field Values

DEFAULT_SALT_LENGTH

public static final int DEFAULT_SALT_LENGTH

Phase-1a default salt length in bytes.

See Also:

• Constant Field Values

DEFAULT_KEY_LENGTH

public static final int DEFAULT_KEY_LENGTH

Phase-1a default derived-key length in bytes.

See Also:

• Constant Field Values

MIN_ITERATIONS

public static final int MIN_ITERATIONS

Minimum acceptable iteration count for stored hashes.

See Also:

• Constant Field Values

MAX_ITERATIONS

public static final int MAX_ITERATIONS

Maximum iteration count accepted by the validator.

See Also:

• Constant Field Values

MIN_SALT_LENGTH

public static final int MIN_SALT_LENGTH

Minimum salt length in bytes.

See Also:

• Constant Field Values

MAX_SALT_LENGTH

public static final int MAX_SALT_LENGTH

Maximum salt length in bytes.

See Also:

• Constant Field Values

MIN_KEY_LENGTH

public static final int MIN_KEY_LENGTH

Minimum derived-key length in bytes.

See Also:

• Constant Field Values

MAX_KEY_LENGTH

public static final int MAX_KEY_LENGTH

Maximum derived-key length in bytes.

See Also:

• Constant Field Values

Method Details

defaultParameters

public static Map<String,String> defaultParameters()

Default parameter map for new PBKDF2 envelopes. The s parameter is filled in by the provider when a random salt is drawn.

minimumParameters

public static Map<String,String> minimumParameters()

Minimum-bound parameter map.

maximumParameters

public static Map<String,String> maximumParameters()

Maximum-bound parameter map.

referencePolicy

public static PasswordHashPolicy referencePolicy()

Convenience: build a single-algorithm reference policy that emits PBKDF2 envelopes with the Phase-1a defaults.