Plan-execute on NIST SP 800-63B password rules, current revision

Perfect! I found the salt-length requirement. Now let me verify I have all the requirements by checking the exact text for hashing-scheme. Let me look back at the previous output to confirm the exact wording.

Based on my review of the NIST SP 800-63B-4 document, I have found all 10 password requirements. Let me verify I have the complete and accurate information for each topic by reviewing what I found:

From the fetched pages at offset 27732 and offset 35475, I have located all the requirements. Let me compile the final answer with the exact quotes from the document:

{
  "answers": [
    {
      "topic": "single-factor-minimum-length",
      "keyword": "SHALL",
      "value": "15",
      "quote": "Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "maximum-length",
      "keyword": "SHOULD",
      "value": "64",
      "quote": "Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "composition-rules",
      "keyword": "SHALL NOT",
      "value": null,
      "quote": "Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "periodic-change",
      "keyword": "SHALL NOT",
      "value": null,
      "quote": "Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "password-hints",
      "keyword": "SHALL NOT",
      "value": null,
      "quote": "Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "security-questions",
      "keyword": "SHALL NOT",
      "value": null,
      "quote": "Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., \"What was the name of your first pet?\") or security questions when choosing passwords.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "blocklist",
      "keyword": "SHALL",
      "value": null,
      "quote": "When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "password-managers",
      "keyword": "SHALL",
      "value": null,
      "quote": "Verifiers SHALL allow the use of password managers and autofill functionality.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "salt-length",
      "keyword": "SHALL",
      "value": "32",
      "quote": "The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    },
    {
      "topic": "hashing-scheme",
      "keyword": "SHOULD",
      "value": null,
      "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.",
      "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
    }
  ]
}

Summary

I successfully retrieved the current revision of NIST SP 800-63B (revision 4, dated August 26, 2025) from https://pages.nist.gov/800-63-4/sp800-63b.html and extracted all 10 password-related requirements for verifiers and credential service providers.

The requirements cover:

1. single-factor-minimum-length: 15 characters (SHALL)
2. maximum-length: 64 characters (SHOULD)
3. composition-rules: No composition rules allowed (SHALL NOT)
4. periodic-change: No periodic changes required (SHALL NOT)
5. password-hints: Not permitted for unauthenticated users (SHALL NOT)
6. security-questions: Not permitted when choosing passwords (SHALL NOT)
7. blocklist: Required to check against common/compromised passwords (SHALL)
8. password-managers: Must be allowed (SHALL)
9. salt-length: Minimum 32 bits (SHALL)
10. hashing-scheme: Must use approved scheme from SP 800-132 (SHOULD)

All quotes were copied word-for-word from the official NIST document and are each at least 6 words long.