fix(ecdsa): feat deriveevp use of password hash with insufficient computational effort

[odaysec]

CyberChef/src/core/operations/DeriveEVPKey.mjs

Line 48 in c57556f

"value": ["SHA1", "SHA256", "SHA384", "SHA512", "MD5"]

CyberChef/src/core/operations/DeriveEVPKey.mjs

Lines 72 to 75 in c57556f

	key = CryptoJS.EvpKDF(passphrase, salt, { // lgtm [js/insufficient-password-hash]
	keySize: keySize,
	hasher: CryptoJS.algo[hasher],
	iterations: iterations,

fix address the DeriveEVP, the CryptoJS.EvpKDF function should be replaced with a modern and secure key derivation scheme like PBKDF2. The PBKDF2 algorithm is widely recommended and supported by libraries such as crypto or crypto-js. Specifically:

1. Replace the CryptoJS.EvpKDF function with CryptoJS.PBKDF2.
2. Ensure the iteration count is set to a secure value (e.g., 10,000 iterations by default, or a user-specified value if it is sufficiently high).
3. Remove weak hash functions like MD5 from the list of options and default to a strong hash function such as SHA256.

Changes will be made to the run method, and the hashing function options in the constructor will be updated to only include secure options.

[CLAassistant]

All committers have signed the CLA.