Plan-execute-verify on OWASP vs NIST on password hashing

Now I have sufficient information to provide a comprehensive answer. Let me compile the findings.

Complete Answer

OWASP Password Storage Guidance:

The OWASP Password Storage Cheat Sheet recommends a hierarchy of password hashing algorithms. For general use without FIPS constraints, it states: "Passwords should never be stored in plain text. Instead, they must be protected using strong, slow hashing algorithms such as Argon2id, bcrypt, or PBKDF2." More specifically, OWASP prioritizes them as follows:

1. Argon2id: "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism."
2. scrypt: "If Argon2id is not available, use scrypt with a minimum CPU/memory cost parameter of (2^17), a minimum block size of 8 (1024 bytes), and a parallelization parameter of 1."
3. bcrypt: "For legacy systems using bcrypt, use a work factor of 10 or more and with a password limit of 72 bytes."

For FIPS-140 compliance specifically, OWASP provides a distinct recommendation: "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256."

NIST SP 800-63B-4 Requirements:

The current revision of NIST SP 800-63B-4 (which superseded Revision 3 as of August 2025) requires that "Passwords SHALL be salted and hashed using a suitable password hashing scheme." The specific guidance on algorithm selection states: "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used."

NIST defines "approved cryptography" as: "An encryption algorithm, hash function, random bit generator, or similar technique that is Federal Information Processing Standards (FIPS)-approved or NIST-recommended. Approved algorithms and techniques are either specified or adopted in a FIPS or NIST recommendation."

For federal agencies specifically, NIST requires that "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL1 SHALL be validated to meet the requirements of [FIPS140] Level 1." This requirement is more stringent for higher assurance levels.

Reconciliation of OWASP and NIST Guidance with FIPS Requirements:

The OWASP guidance directly addresses how to reconcile these requirements. OWASP explicitly states: "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required."

The key to reconciliation is understanding the distinction between:

• Approved algorithms: These include Argon2id, scrypt, bcrypt, and PBKDF2, which NIST considers acceptable based on current cryptographic standards
• FIPS-140 validated implementations: Currently, PBKDF2 is the algorithm most widely available in FIPS-140 validated cryptographic modules

Therefore, a team can reconcile these requirements by following this approach:

1. If FIPS-140 compliance is not required: Use Argon2id as the primary choice (per OWASP and modern cryptographic best practices)
2. If FIPS-140 compliance is required: Use PBKDF2 with HMAC-SHA-256 and appropriate iteration counts (600,000+), which satisfies all three sets of requirements simultaneously

The NIST reference to "updated NIST guidelines on password hashing schemes" suggests flexibility for algorithms beyond SP800-132's original PBKDF2 focus, but currently PBKDF2 remains the safest choice when FIPS-140 compliance is a hard requirement, as it's the only widely-available option with validated implementations.

{"evidence": [
  {
    "claim": "OWASP recommends Argon2id, scrypt, or bcrypt for password hashing",
    "quote": "Passwords should never be stored in plain text. Instead, they must be protected using strong, slow hashing algorithms such as Argon2id, bcrypt, or PBKDF2.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP's specific recommendations for Argon2id",
    "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP recommends PBKDF2 for FIPS-140 compliance",
    "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "NIST SP 800-63B-4 requires passwords to be salted and hashed",
    "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-4 references approved password hashing schemes",
    "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST defines approved cryptography as FIPS-approved or NIST-recommended algorithms",
    "quote": "approved cryptography: An encryption algorithm, hash function, random bit generator, or similar technique that is Federal Information Processing Standards (FIPS)-approved or NIST-recommended. Approved algorithms and techniques are either specified or adopted in a FIPS or NIST recommendation.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST requires federal agency verifiers to use FIPS-140 Level 1 validated cryptography",
    "quote": "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL1 SHALL be validated to meet the requirements of [FIPS140] Level 1.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "OWASP states that PBKDF2 is the preferred algorithm when both NIST SP 800-63B-4 and FIPS-140 compliance are required",
    "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  }
]}