Gated-execute on OWASP vs NIST on password hashing

Now I have all the information I need to provide a comprehensive answer. Let me compile the findings.

Answer

A team must reconcile two different but complementary guidance sources when selecting a password hashing algorithm for FIPS compliance:

OWASP Password Storage Guidance Recommendations:

The OWASP Password Storage Cheat Sheet provides a clear hierarchy of password hashing algorithms. It states: "Passwords should never be stored in plain text. Instead, they must be protected using strong, slow hashing algorithms such as Argon2id, bcrypt, or PBKDF2." More specifically, OWASP recommends:

• Primary choice: Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism
• Secondary choice: scrypt with a minimum CPU/memory cost parameter of 2^17
• Legacy systems only: bcrypt with a work factor of 10 or more
• For FIPS-140 compliance: "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256."

The OWASP cheat sheet further explains that "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required."

NIST SP 800-63B-4 Requirements:

The current revision of NIST SP 800-63B-4 (Revision 4) does not mandate specific password hashing algorithms by name. Instead, it requires: "Passwords SHALL be salted and hashed using a suitable password hashing scheme" and "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used."

NIST SP 800-63B-4 defines "approved cryptography" as: "An encryption algorithm, hash function, random bit generator, or similar technique that is Federal Information Processing Standards (FIPS)-approved or NIST-recommended. Approved algorithms and techniques are either specified or adopted in a FIPS or NIST recommendation."

This definition is important because it allows for two categories of approved algorithms:

1. FIPS-approved algorithms (such as PBKDF2, which is specified in NIST SP 800-132)
2. NIST-recommended algorithms (which could include modern algorithms like Argon2)

How to Reconcile the Two:

The two sources align by recognizing that password hashing requirements depend on compliance constraints:

1. For systems without FIPS requirements: Follow OWASP's preference hierarchy (Argon2id > scrypt > bcrypt), as these are modern, memory-hard algorithms that resist GPU and ASIC attacks while remaining efficient for legitimate use. These align with NIST's flexibility in accepting any "approved" (NIST-recommended) password hashing scheme.
2. For systems with FIPS-140 compliance requirements: Use PBKDF2 with HMAC-SHA-256 and 600,000 iterations as OWASP specifies. PBKDF2 is an "approved password hashing scheme" under NIST SP 800-63B-4 because it is specified in NIST SP 800-132, making it FIPS-approved and satisfying both federal compliance requirements and NIST's guidance.
3. Work factors and cost: Both sources agree that the work factor or cost parameter should be adjusted over time to account for increases in computing performance, without negatively impacting verifier performance.

The apparent difference between OWASP's modern algorithm preferences (Argon2id, scrypt) and NIST's reference to SP 800-132 (which primarily covers PBKDF2) is not actually a conflict. NIST SP 800-63B-4 explicitly allows "updated NIST guidelines on password hashing schemes," suggesting openness to newer algorithms. OWASP's conditional recommendation of PBKDF2 for FIPS compliance reflects the practical reality that only PBKDF2 currently has both FIPS-140 validated implementations and the necessary specification status to satisfy federal requirements.

{"evidence": [
  {
    "claim": "OWASP recommends Argon2id as the primary password hashing algorithm with specific parameters",
    "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP recommends PBKDF2 for FIPS-140 compliance",
    "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP states PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations",
    "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "NIST SP 800-63B-4 requires passwords to be salted and hashed using a suitable password hashing scheme",
    "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme. Password hashing schemes take a password, a salt, and a cost factor as inputs and generate a password hash.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-4 allows either FIPS-approved or NIST-recommended password hashing schemes",
    "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST defines approved cryptography as either FIPS-approved or NIST-recommended",
    "quote": "An encryption algorithm, hash function, random bit generator, or similar technique that is Federal Information Processing Standards (FIPS)-approved or NIST-recommended. Approved algorithms and techniques are either specified or adopted in a FIPS or NIST recommendation.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  }
]}