Plan-execute on NIST SP 800-63B password rules, current revision

Perfect! Now I have all the information I need to compile the comprehensive answer. Let me verify I have accurate quotes for each requirement from the NIST SP 800-63B-4 document.

Based on my research of the current revision of NIST SP 800-63B (revision 4, published August 2025), I found the password requirements for verifiers and credential service providers in Section 3.1.1. Here's what the document requires for each topic:

Summary of Findings:

The current NIST SP 800-63B-4 specifies clear requirements for password handling by verifiers and CSPs:

1. Single-factor passwords must be at least 15 characters (SHALL requirement)
2. Maximum length should be at least 64 characters (SHOULD requirement)
3. Composition rules like requiring character type mixtures are explicitly prohibited (SHALL NOT)
4. Periodic password changes are not required, though forced changes are permitted if compromise is detected (SHALL NOT)
5. Password hints accessible to unauthenticated users are prohibited (SHALL NOT)
6. Security questions/KBA for password selection are prohibited (SHALL NOT)
7. Blocklist checking for commonly used and compromised passwords is required (SHALL)
8. Password managers and autofill are explicitly allowed (SHALL)
9. Salt length for password hashing must be at least 32 bits (SHALL)
10. Hashing scheme should use approved schemes from SP 800-132 (SHOULD)

{
  "answers": [
    {
      "topic": "single-factor-minimum-length",
      "keyword": "SHALL",
      "value": "15",
      "quote": "Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "maximum-length",
      "keyword": "SHOULD",
      "value": "64",
      "quote": "Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "composition-rules",
      "keyword": "SHALL NOT",
      "value": null,
      "quote": "Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "periodic-change",
      "keyword": "SHALL NOT",
      "value": null,
      "quote": "Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "password-hints",
      "keyword": "SHALL NOT",
      "value": null,
      "quote": "Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "security-questions",
      "keyword": "SHALL NOT",
      "value": null,
      "quote": "Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., \"What was the name of your first pet?\") or security questions when choosing passwords.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "blocklist",
      "keyword": "SHALL",
      "value": null,
      "quote": "When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "password-managers",
      "keyword": "SHALL",
      "value": null,
      "quote": "Verifiers SHALL allow the use of password managers and autofill functionality.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "salt-length",
      "keyword": "SHALL",
      "value": "32",
      "quote": "The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "hashing-scheme",
      "keyword": "SHOULD",
      "value": null,
      "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    }
  ]
}