Orchestrator-workers on OWASP vs NIST on password hashing

Password Hashing for FIPS-Compliant Web Services: OWASP and NIST Guidance

Based on the worker research, here is what each source recommends and how to reconcile them:

OWASP Password Storage Guidance

OWASP provides specific algorithm recommendations in a clear hierarchy. For general applications without FIPS requirements, OWASP recommends modern memory-hard algorithms:

• Primary recommendation: Argon2id with minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism
• Fallback option: scrypt with a CPU/memory cost parameter of 2^17, a block size of 8, and a parallelization parameter of 1
• Legacy systems only: bcrypt with a work factor of 10 or more and a password limit of 72 bytes

Critically, OWASP provides separate guidance specifically for FIPS-140 compliance: use PBKDF2 with a work factor of 600,000 or more using HMAC-SHA-256 as the internal hash function. OWASP explicitly states the rationale: "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required."

NIST SP 800-63B-4 (Current Revision) Requirements

NIST SP 800-63B-4 takes a more flexible, functional approach rather than mandating specific algorithms. The requirement is that passwords "SHALL be salted and hashed using a suitable password hashing scheme." The document specifies that an "approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes" should be used.

NIST's functional requirements for password hashing include:

• Salt "SHALL be at least 32 bits in length"
• Cost factor "SHOULD be as high as practical without negatively impacting verifier performance"
• Cost factor "SHOULD be increased over time to account for increases in computing performance"

Notably, NIST SP 800-63B-4 does not explicitly mandate FIPS-140 validation for the password hashing algorithm itself, though it defines "approved cryptography" as either "FIPS-approved or NIST-recommended." This flexibility allows both traditional FIPS-approved algorithms and newer NIST-recommended approaches.

How to Reconcile the Two Sources

There is no fundamental conflict between OWASP and NIST guidance—they operate at different levels of prescription. The reconciliation is straightforward and depends on whether your service requires FIPS compliance:

Without FIPS requirements: Follow OWASP's preference hierarchy. Use Argon2id as your primary choice, which aligns with NIST's reference to "updated NIST guidelines" and NIST SP 800-63B-3's endorsement of memory-hard functions as technically superior for password security.

With FIPS-140 compliance requirements: Both sources converge on the same answer. Use PBKDF2 with at least 600,000 iterations (per OWASP's recommendation) with HMAC-SHA-256. This satisfies OWASP's FIPS-specific guidance and meets NIST SP 800-63B-4's requirement for an "approved password hashing scheme" because PBKDF2 is specified in SP 800-132 (a NIST standard) and has FIPS-140 validated implementations available.

The key insight is that FIPS-140 is a compliance certification framework for cryptographic implementations, not a technical superiority requirement. Argon2id and scrypt provide better security properties, but PBKDF2 is the practical choice for FIPS compliance because implementations using only FIPS-approved primitives (SHA-256, HMAC) can be certified.

{"evidence": [
  {
    "claim": "OWASP recommends Argon2id as the primary password hashing algorithm with minimum 19 MiB memory, iteration count of 2, and parallelism of 1",
    "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP recommends scrypt as a fallback to Argon2id with specific cost parameters",
    "quote": "If Argon2id is not available, use scrypt with a minimum CPU/memory cost parameter of (2^17), a minimum block size of 8 (1024 bytes), and a parallelization parameter of 1.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP recommends PBKDF2 with 600,000 iterations and HMAC-SHA-256 for FIPS-140 compliance",
    "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP states that PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations",
    "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "NIST SP 800-63B-4 requires passwords to be salted and hashed using a suitable password hashing scheme",
    "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-4 references SP 800-132 or updated NIST guidelines for approved password hashing schemes",
    "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-4 requires salt to be at least 32 bits in length",
    "quote": "The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-4 requires cost factor to be as high as practical and increased over time",
    "quote": "The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance. It SHOULD be increased over time to account for increases in computing performance.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST defines approved cryptography as FIPS-approved or NIST-recommended",
    "quote": "approved cryptography An encryption algorithm, hash function, random bit generator, or similar technique that is Federal Information Processing Standards (FIPS)-approved or NIST-recommended.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-3 recommended PBKDF2 and memory-hard functions like Balloon",
    "quote": "Examples of suitable key derivation functions include Password-based Key Derivation Function 2 (PBKDF2) [SP 800-132] and Balloon [BALLOON]. A memory-hard function SHOULD be used because it increases the cost of an attack.",
    "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"
  }
]}