Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature request. Allow OWASP FIPS-140 Password Iterations 310000 or more #642

Open
MsJamie opened this issue Dec 26, 2022 · 2 comments
Open

Comments

@MsJamie
Copy link

MsJamie commented Dec 26, 2022

Can you add the ability to use alternative settings for Password Iterations without breaking lastpass-cli?

For example I'd like to use the OWASP FIPS-140 compliance https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

If FIPS-140 compliance is required, use PBKDF2 with a work factor of 310,000 or more and set with an internal hash function of HMAC-SHA-256.

However as related to #604 you have to use 100100 or receive unknown when trying to login

@0xdevalias
Copy link

Looks like May 1 will be when this version of the CLI ceases to work correctly (unless they make required changes before then):

image

Originally posted by @0xdevalias in #604 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants