(sling-org-apache-sling-commons-crypto) branch master updated: SLING-13280 Use 220000 key iterations by default according to OWASP PBKDF2 recommendations

[kwin]

This is an automated email from the ASF dual-hosted git repository.

kwin pushed a commit to branch master
in repository 
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-commons-crypto.git


The following commit(s) were added to refs/heads/master by this push:
     new 64252ac  SLING-13280 Use 220000 key iterations by default according to 
OWASP PBKDF2 recommendations
64252ac is described below

commit 64252acc9918807f142c8b060e4f90945a108c4b
Author: Konrad Windszus <k...@apache.org>
AuthorDate: Sun Sep 13 12:07:05 2026 +0200

    SLING-13280 Use 220000 key iterations by default according to OWASP
    PBKDF2 recommendations
    
    
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
---
 .../commons/crypto/jca/internal/JcaPbeCryptoServiceConfiguration.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git 
a/src/main/java/org/apache/sling/commons/crypto/jca/internal/JcaPbeCryptoServiceConfiguration.java
 
b/src/main/java/org/apache/sling/commons/crypto/jca/internal/JcaPbeCryptoServiceConfiguration.java
index a41e208..8deaf03 100644
--- 
a/src/main/java/org/apache/sling/commons/crypto/jca/internal/JcaPbeCryptoServiceConfiguration.java
+++ 
b/src/main/java/org/apache/sling/commons/crypto/jca/internal/JcaPbeCryptoServiceConfiguration.java
@@ -58,7 +58,7 @@ import 
org.osgi.service.metatype.annotations.ObjectClassDefinition;
         description = "Number of iterations to derive a key from the password 
as defined in the PBE algorithm. The higher the number of iterations, the more 
secure the key derivation is,"
                 + " but it also increases the time taken to derive the key."
     )
-    int numKeyIterations() default 65536;
+    int numKeyIterations() default 220000;
 
     @AttributeDefinition(
         name = "PBE Key Length (bits)",