Gated-execute on OWASP vs NIST on password hashing

Now I have comprehensive information from both sources. Let me compile the findings into a complete answer.

Answer

OWASP Password Storage Guidance

OWASP recommends a tiered approach to password hashing based on availability and compliance requirements. According to the OWASP Password Storage Cheat Sheet, the preferred algorithms for secure password storage are:

1. Argon2id (first choice) with minimum configuration of 19 MiB of memory, 2 iterations, and 1 degree of parallelism
2. scrypt (if Argon2id unavailable) with minimum CPU/memory cost parameter of 2^17, block size of 8 (1024 bytes), and parallelization parameter of 1
3. bcrypt (for legacy systems only) with a work factor of 10 or more

However, when FIPS-140 compliance is required, OWASP recommends a different approach: PBKDF2 with a work factor of 600,000 or more iterations and HMAC-SHA-256 as the internal hash function.

NIST SP 800-63B-4 Requirements

The current revision of NIST SP 800-63B-4 (published 2023) provides more cautious guidance on password hashing. The standard specifies that "Passwords SHALL be salted and hashed using a suitable password hashing scheme." Regarding specific algorithms, NIST 800-63B-4 states: "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used."

Notably, NIST 800-63B-4 does not name specific algorithms like Argon2id, scrypt, or bcrypt. Instead, it defers to SP 800-132 (from 2010), which focuses on PBKDF2 as a password-based key derivation function. The standard requires that at least 32 bits of salt be used, that the salt and hash be stored with each password, and that the hashing scheme reference and cost factor be stored to enable future algorithm migration.

For federal agencies, NIST 800-63B-4 requires that "Cryptography used by verifiers operated by or on behalf of federal agencies" must be validated to meet FIPS 140 Level 1 requirements.

Reconciling the Two Approaches

The apparent tension between OWASP and NIST SP 800-63B-4 can be reconciled by understanding that they address different priorities:

1. OWASP's Recommendation Hierarchy: OWASP prioritizes modern cryptographic best practices for maximum security. Argon2id is recommended because it specifically won the 2015 Password Hashing Competition and resists both GPU and memory-based attacks. PBKDF2 is acceptable but is ranked lower on the preference ladder.
2. NIST's Conservative Approach: NIST SP 800-63B-4 uses the word "SHOULD" rather than "SHALL" when recommending approved schemes, indicating flexibility. By referencing SP 800-132 and "updated NIST guidelines," NIST creates a pathway for modern algorithms without formally standardizing them in 800-63B-4 itself.
3. FIPS 140 Compliance: This is where the two sources genuinely diverge for practical implementation. While modern algorithms like Argon2id are stronger, FIPS 140-2/140-3 validated implementations are currently rare for these algorithms. PBKDF2 has extensive FIPS 140 validated implementations because it's based on HMAC and standard hash functions (like SHA-256) that are already FIPS-approved.

4. Recommended Reconciliation Strategy: For teams needing FIPS compliance, the practical solution is:

   • Use PBKDF2 with HMAC-SHA-256 and 600,000+ iterations to satisfy both NIST SP 800-63B-4 (as an approved scheme per SP 800-132) and FIPS 140 requirements
   • Implement a migration path to Argon2id or another modern algorithm once FIPS-validated implementations become more widely available
   • OWASP's emphasis on storing algorithm and cost factor metadata supports this strategy, as it enables algorithm upgrades when security needs or compliance rules change

The key insight is that PBKDF2 is not OWASP's first choice for security reasons, but it is the pragmatic choice when federal compliance mandates FIPS-validated cryptography.

{"evidence": [{"claim": "OWASP recommends Argon2id as the primary password hashing algorithm with minimum 19 MiB of memory, 2 iterations, and 1 degree of parallelism", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "OWASP recommends PBKDF2 for FIPS-140 compliance with 600,000 or more iterations and HMAC-SHA-256", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, making it the preferred algorithm when these are required", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "NIST SP 800-63B-4 requires that passwords be salted and hashed using a suitable password hashing scheme", "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST SP 800-63B-4 recommends using an approved password hashing scheme from SP 800-132 or updated NIST guidelines", "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST requires cryptography used by federal agency verifiers to be validated to FIPS 140 Level 1 requirements", "quote": "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL1 SHALL be validated to meet the requirements of [FIPS140] Level 1.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "OWASP Password Storage Cheat Sheet recommends storing a reference to the password hashing scheme used, including the cost factor, to allow migration to new algorithms", "quote": "Remember that once your password hashing method is selected, it will have to be upgraded in the future, so ensure that upgrading your hashing algorithm is as easy as possible.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}]}