Home > taxonomy > asvs 4.0.3 > 02 authentication > 06 look up secret verifier
Look-up Secret Verifier V2.6.1 Verify that lookup secrets can be used only once.
Level 1 required: False
Level 2 required: True
Level 3 required: True
CWE: 308
V2.6.2 Verify that lookup secrets have sufficient randomness (112 bits of entropy), or if less than 112 bits of entropy, salted with a unique and random 32-bit salt and hashed with an approved one-way hash.
Level 1 required: False
Level 2 required: True
Level 3 required: True
CWE: 330
V2.6.3 Verify that lookup secrets are resistant to offline attacks, such as predictable values.
Level 1 required: False
Level 2 required: True
Level 3 required: True
CWE: 310
Disclaimer: Credit via OWASP ASVS . For more information visit The OWASP ASVS Project or Github respository. . OWASP ASVS is under the Creative Commons Attribution-Share Alike v3.0 license.
OWASP Cornucopia
OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams identify security requirements in Agile, conventional and formal development processes. It is language, platform and technology-agnostic, and is free to use. OWASP Cornucopia is licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar licence to this one. © 2012-2025 OWASP Foundation. The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software.
