ScaffoldBench

RunHaiku 4.5repeat 2

Propose-select on NIST SP 800-63B password rules, current revision

claude-haiku-4-5-20251001__propose-select__research-nist-password-rules__r2

Score

1.000

passed
design ran as designed
Cost
$0.234
Latency
1m 38s
setup 0.0s, grading 0.0s
Turns
28
Tool calls
23
Subagents
3
Tokens in / out
202k / 21k
129,561 read from cache

Did the design run?

every check held
  • Run completed: heldharness.run-completedThe environment was built, the architecture returned and grading finished, none of them throwing.
  • No API failures: heldharness.apiNo model call failed at the API.
  • Every call ended: heldharness.calls-endedEvery call ended with a result, or was stopped by the run's own limits.
  • No harness tool denied: heldharness.harness-toolsThe sandbox guard never denied a harness tool, nor a tool the session itself offered.
  • Tool servers connected: heldharness.mcp-connectedEvery tool server the harness gave a call was connected when the session started.
  • No foreign tool servers: heldharness.mcp-hermeticNo call loaded a tool server the harness did not give it.
  • Builtin tools: heldharness.builtin-toolsA check recorded with the run.
  • Structured replies arrived: heldharness.structured-outputEvery call that asked for structured output and ran to the end got it.
  • No silent fallbacks: heldharness.not-degradedNo phase fell back on a default (an empty plan, a default winner) instead of its output.
  • All three proposers ran: heldpropose-select.proposalsThree proposers ran in parallel, each from its own angle, and none was starved while another ran.
  • The selector chose: heldpropose-select.selectionThe selector picked a proposal by a valid number, read from its schema reply and not a default.
  • Each call was shown the right tools: heldpropose-select.toolsEach proposer was shown the read-only tools, the selector none, and the executor the full toolset.

Phases

Proposal 1 (policy-first): 0.0s to 39.7s, finished, 9 tool calls, $0.061
Proposal 2 (state-first): 0.0s to 38.1s, finished, 6 tool calls, $0.056
Proposal 3 (outcome-first): 0.0s to 43.9s, finished, 8 tool calls, $0.064
Select: 43.9s to 1m 38s, finished, 0 tool calls, $0.053

Drawn from the phase records: timing and cost per call, no tool calls or messages.

PhaseDurationCostTurnsToolsModel
Proposal 1 (policy-first)39.7s$0.061109claude-haiku-4-5-20251001
Proposal 2 (state-first)38.1s$0.05676claude-haiku-4-5-20251001
Proposal 3 (outcome-first)43.9s$0.06498claude-haiku-4-5-20251001
Select54.5s$0.05320claude-haiku-4-5-20251001

The call-by-call replay is not published for this run. Traces are large, so the repository keeps 9 of this run set’s 900 and leaves the rest out; the score, phases and final answer on this page come from the committed run record.

Runs you can replay

Record this cell yourself: npm run bench -- run --strategies propose-select --tasks research-nist-password-rules --models claude-haiku-4-5-20251001 --repeats 1

Score breakdown

  • passtopic single-factor-minimum-length: minimum length of a password used as the only authentication factor (characters)
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic maximum-length: the maximum password length verifiers permit (characters)
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic composition-rules: imposing composition rules, such as requiring a mix of character types
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic periodic-change: requiring subscribers to change their passwords periodically
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic password-hints: letting subscribers store a password hint that unauthenticated claimants can see
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic security-questions: prompting for knowledge-based authentication or security questions when a password is chosen
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic blocklist: checking a new password against a blocklist of commonly used, expected or compromised passwords
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic password-managers: allowing password managers and autofill
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic salt-length: the length of the salt used when storing passwords (bits)
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic hashing-scheme: using an approved password hashing scheme from the latest revision of SP 800-132
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

Penalties

No penalties were applied.

Scorer metadata

corpus
{"version":2,"snapshot":"2026-10-01","hash":"0786c624b04f6c85e2ed8a55d4acedd99e4cf2c18632a0ebc22ee969fb3e2263","documents":4}
opened documents
["nist-sp800-63b-4"]
opened by role
{"primary":["nist-sp800-63b-4"]}
displayed share
{"nist-sp800-63b-3":0.0014,"owasp-authentication":0.0061,"nist-sp800-63b-4":0.099,"owasp-password-storage":0.0132}
cited count
1
verified count
1
hallucinated count
0
citation integrity
1
hallucinated urls
[]
answer block
true
answer block repaired
false
items answered
10
item count
10
field accuracy
1
grounded items
10
field misses
{}

Final answer

Based on my research of the current revision (Revision 4, published August 26, 2025) of NIST SP 800-63B, I found all the password-related requirements in Section 3.1.1.2 "Password Verifiers." Here are the password requirements for verifiers and credential service providers:

Key Findings:

The requirements are consistently clear about what verifiers and credential service providers (CSPs) must do regarding passwords. Several important policy decisions stand out:

  1. Single-factor minimum length is 15 characters (not 8 — the 8-character minimum applies only to multi-factor passwords)
  2. Composition rules are explicitly prohibited rather than required
  3. Periodic password change is prohibited unless compromise is detected
  4. Password hints and security questions are prohibited
  5. Blocklist checking is mandatory
  6. Password managers must be allowed
  7. Salt length is 32 bits minimum
  8. Hashing must follow SP 800-132

All requirements come from the same section of the document, making this a cohesive policy section. The emphasis throughout is on entropy over composition, on preventing forced changes, and on supporting password managers—a significant shift toward usability and modern security practices.

{"answers":[{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., \"What was the name of your first pet?\") or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}]}

Provenance of the numbers on this page

run set
scaffold-or-scale-v1
models
Haiku 4.5, Sonnet 5.5, Opus 5.5
effort
high
repeats
2
fixtures
replay
runs
900 / 900
strategy cost
$354.44
judge cost
$9.19
wall clock
9h 48m
git
fce5807b2d

Cost excludes judge calls, which are tracked separately so a scoring model never flatters or penalises an architecture. Every figure on this site is read from results/ at build time.