Plan-execute on OWASP vs NIST on password hashing

Perfect! Now I have all the information needed. Let me compile the findings.

Summary

OWASP Password Storage Guidance:

OWASP recommends a tiered approach: The primary recommendation is to use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism. If Argon2id is unavailable, the guidance suggests scrypt as an alternative, and acknowledges bcrypt for legacy systems. However, OWASP explicitly addresses FIPS compliance: when FIPS-140 compliance is required, the guidance specifies using PBKDF2 with a work factor of 600,000 or more and HMAC-SHA-256. OWASP notes that "PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations."

NIST SP 800-63B-4 Requirements:

The current NIST SP 800-63B-4 requires that passwords be "salted and hashed using a suitable password hashing scheme" and directs implementers to use "an approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes." Rather than prescribing specific algorithms, NIST takes a more flexible approach, referencing both legacy NIST SP 800-132 (which covers PBKDF2) and updated NIST guidelines. The guidance emphasizes that the cost factor "SHOULD be as high as practical without negatively impacting verifier performance" and "SHOULD be increased over time to account for increases in computing performance."

Reconciliation of OWASP and NIST:

The two sources can be reconciled by understanding their different scopes: OWASP provides practical implementation guidance with explicit algorithm recommendations prioritized by security strength and modern design, while NIST provides regulatory compliance flexibility. The key reconciliation point is that OWASP explicitly recognizes FIPS-140 as a distinct requirement and provides PBKDF2 as the solution when this compliance is needed. When a team does not have FIPS-140 requirements, they should follow OWASP's preferred modern algorithms (Argon2id or scrypt). When they do have FIPS-140 requirements, both OWASP and NIST support PBKDF2 as the appropriate choice. NIST SP 800-63B-4 permits this flexibility by allowing "approved password hashing schemes," which includes both modern algorithms (increasingly recognized in updated NIST guidelines) and FIPS-validated schemes like PBKDF2.

{"evidence": [{"claim": "OWASP's primary password hashing recommendation is Argon2id with specific minimum parameters", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "OWASP recommends PBKDF2 when FIPS-140 compliance is required, with specific work factor and hash function", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "OWASP explicitly identifies PBKDF2 as appropriate for FIPS-140 compliance and notes NIST SP 800-63B-4 support", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "NIST SP 800-63B-4 requires passwords be hashed with suitable password hashing schemes, referencing NIST SP 800-132 and updated guidelines", "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme... An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST SP 800-63B-4 recommends increasing the cost factor of password hashing over time", "quote": "The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance. It SHOULD be increased over time to account for increases in computing performance.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST SP 800-63 Revision 3 mentions PBKDF2 and Balloon as suitable key derivation functions, with preference for memory-hard functions", "quote": "Examples of suitable key derivation functions include Password-based Key Derivation Function 2 (PBKDF2) [SP 800-132] and Balloon [BALLOON]. A memory-hard function SHOULD be used because it increases the cost of an attack.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"}, {"claim": "NIST SP 800-63 Revision 3 recommends PBKDF2 iteration count of at least 10,000", "quote": "For PBKDF2, the cost factor is an iteration count: the more times the PBKDF2 function is iterated, the longer it takes to compute the password hash. Therefore, the iteration count SHOULD be as large as verification server performance will allow, typically at least 10,000 iterations.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"}]}