Plan-execute on OWASP vs NIST on password hashing

Now let me compile a comprehensive answer based on the authoritative sources I've researched.

Answer

OWASP Password Storage Guidance:

OWASP's Password Storage Cheat Sheet recommends different algorithms based on your compliance requirements:

For applications without FIPS requirements, OWASP recommends Argon2id as the primary choice for new systems. The cheat sheet specifies that organizations should "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism." If Argon2id is unavailable, OWASP recommends scrypt as an alternative, and for legacy systems, bcrypt with a work factor of 10 or more.

However, when FIPS-140 compliance is required, OWASP explicitly states: "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256." Additionally, OWASP notes that "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required."

NIST SP 800-63B Requirements:

NIST's current guidance in SP 800-63B-4 states that "Passwords SHALL be salted and hashed using a suitable password hashing scheme" and that "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used." The cost factor "SHOULD be as high as practical without negatively impacting verifier performance" and "SHOULD be increased over time to account for increases in computing performance."

NIST SP 800-132 (from 2010), which is the current approved standard referenced, specifies PBKDF2. However, the earlier NIST SP 800-63B Revision 3 was more progressive, noting that "Examples of suitable key derivation functions include Password-based Key Derivation Function 2 (PBKDF2) [SP 800-132] and Balloon [BALLOON]" and importantly stating that "A memory-hard function SHOULD be used because it increases the cost of an attack."

Reconciling the Two for FIPS Compliance:

The key to reconciliation is understanding the different purposes of these documents:

1. For federal FIPS-140 compliance: Teams must use PBKDF2 with HMAC-SHA-256 and at least 600,000 iterations, as this is the only algorithm with FIPS-140 validated implementations. This is what both OWASP and NIST effectively require for federal compliance.
2. For non-FIPS federal systems: Teams can follow OWASP's recommendation to use Argon2id as the preferred algorithm. While NIST SP 800-63B-4 references "updated NIST guidelines," no official NIST document currently approves Argon2, bcrypt, or scrypt as replacements for the SP 800-132 PBKDF2 standard. However, NIST's own 800-63B Rev 3 acknowledges that memory-hard functions should be used.
3. The practical path forward: If federal FIPS compliance is required, use PBKDF2. If not required, teams can use Argon2id following OWASP guidance, which provides better security through memory-hard properties. The recommendations align on the principle that password hashing must be slow and computationally expensive; they differ only on which algorithms meet that requirement under different regulatory constraints.

{"evidence": [{"claim": "OWASP recommends Argon2id with minimum 19 MiB memory, 2 iterations, and 1 degree of parallelism as the primary password hashing algorithm", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "OWASP specifies PBKDF2 with 600,000 iterations and HMAC-SHA-256 for FIPS-140 compliance", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "OWASP states that PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "NIST SP 800-63B-4 requires passwords to be salted and hashed using a suitable password hashing scheme", "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST SP 800-63B-4 references approved schemes from SP 800-132 or updated NIST guidelines", "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST SP 800-63B-4 requires cost factor to be as high as practical and increased over time", "quote": "The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance. It SHOULD be increased over time to account for increases in computing performance.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST SP 800-63B Rev 3 lists PBKDF2 and Balloon as suitable key derivation functions", "quote": "Examples of suitable key derivation functions include Password-based Key Derivation Function 2 (PBKDF2) [SP 800-132] and Balloon [BALLOON].", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"}, {"claim": "NIST SP 800-63B Rev 3 emphasizes that memory-hard functions should be used", "quote": "A memory-hard function SHOULD be used because it increases the cost of an attack.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"}]}