Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-007

Weak hash for password

highSwiftCWE-327CVSS 7.5

What it detects

MD5 or SHA1 is used to hash passwords, which is cryptographically broken.

How to fix

Use a memory-hard KDF such as Argon2, scrypt, or PBKDF2 with a salt for passwords.

Vulnerable — Shield flags thisPasswordHasher.swift
import CommonCrypto
import Foundation

func hashPassword(_ password: String) -> [UInt8] {
    let data = Array(password.utf8)
    var digest = [UInt8](repeating: 0, count: Int(CC_MD5_DIGEST_LENGTH))
    CC_MD5(data, CC_LONG(data.count), &digest)
    return digest
}
Fixed — scans cleanPasswordHasher.swift
import CommonCrypto
import Foundation

func hashPassword(_ password: String, salt: [UInt8]) -> [UInt8] {
    var derived = [UInt8](repeating: 0, count: 32)
    CCKeyDerivationPBKDF(CCPBKDFAlgorithm(kCCPBKDF2), password, password.utf8.count,
                         salt, salt.count, CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256),
                         600_000, &derived, derived.count)
    return derived
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-007, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-SWIFT-007: Weak hash for password — Zennoxa Shield