Propose-select on OWASP vs NIST on password hashing

Analysis and Recommendation

A team choosing a password hashing algorithm for a web service with US federal (FIPS) requirements should understand that OWASP and NIST differ on their primary recommendations, but these differences can be reconciled by prioritizing FIPS compliance when required.

What OWASP Recommends

OWASP's Password Storage Cheat Sheet provides a clear hierarchy of algorithms based on security effectiveness. The guidance states: "Passwords should never be stored in plain text. Instead, they must be protected using strong, slow hashing algorithms such as Argon2id, bcrypt, or PBKDF2." The preferred recommendation is Argon2id with minimum configuration of 19 MiB of memory, 2 iterations, and 1 degree of parallelism. When Argon2id is not available, OWASP recommends scrypt with cost parameter of 2^17, block size of 8, and parallelization parameter of 1. However, critically, OWASP acknowledges the FIPS requirement: "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256."

Additionally, OWASP explains the rationale for PBKDF2 when FIPS compliance is needed, noting: "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required."

What NIST SP 800-63B-4 (Current Revision) Requires

NIST SP 800-63B-4 requires that "Passwords SHALL be salted and hashed using a suitable password hashing scheme." Regarding which schemes to use, NIST states that "an approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used." This language indicates NIST references both the 2010 SP800-132 standard (which covers PBKDF2) and allows for updated guidance.

Importantly, NIST SP 800-63B-4 distinguishes between "approved cryptography" (which can be either FIPS-approved or NIST-recommended algorithms) and the requirement for FIPS 140 Level 1 validation. For non-federal users, NIST permits NIST-recommended algorithms: "Authenticators used at AAL1 SHALL use approved cryptography. In other words, they must use approved algorithms, but the implementation need not be validated under [FIPS140]."

However, for federal agencies specifically, a stricter requirement applies: "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL1 SHALL be validated to meet the requirements of [FIPS140] Level 1." This means teams operating verifiers for federal agencies cannot use Argon2id, scrypt, or bcrypt—even though NIST accepts these as approved algorithms in general.

How to Reconcile the Two Sources

The apparent conflict dissolves when examining FIPS requirements carefully:

1. For Non-FIPS Systems: Teams should follow OWASP's preferred recommendations and use Argon2id as the first choice, since it offers superior security against both GPU and memory-based attacks. Argon2id is an "approved algorithm" under NIST SP 800-63B-4 and qualifies for general use.
2. For FIPS-140 Compliance (Federal Agencies): Teams must use PBKDF2 with HMAC-SHA-256 at a minimum of 600,000 iterations. This is because PBKDF2 is built using FIPS-approved cryptographic primitives (HMAC and SHA-256), while Argon2, scrypt, and bcrypt are not FIPS-approved password hashing algorithms despite their superior security characteristics.

3. The Strategic Path: If a federal system needs both strong security and FIPS compliance, the recommendation is:

   • Use PBKDF2 with HMAC-SHA-256 and 600,000+ iterations initially to meet FIPS 140 requirements
   • Monitor NIST's "updated guidelines on password hashing schemes" mentioned in SP 800-63B-4, as NIST may eventually approve Argon2 or similar algorithms
   • Plan for future migration to stronger algorithms as FIPS approvals evolve
   • Ensure iteration counts increase over time as computing power increases

The key insight is that OWASP's conditional guidance acknowledges this exact constraint: when FIPS-140 compliance is required, the choice is predetermined to PBKDF2, despite Argon2id being objectively more secure in other contexts. NIST's definition of "approved cryptography" is broader (including NIST-recommended algorithms), but FIPS 140 validation narrows the acceptable choices for federal agencies.

{"evidence": [{"claim": "OWASP recommends Argon2id as the strongest algorithm for password hashing in general use", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "OWASP specifies PBKDF2 for FIPS-140 compliance", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "OWASP explains that PBKDF2 should be preferred when FIPS compliance is required because it has FIPS-validated implementations", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "NIST SP 800-63B-4 requires passwords to be salted and hashed using a suitable password hashing scheme", "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST SP 800-63B-4 references approved password hashing schemes from SP800-132 or updated NIST guidelines", "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST defines approved cryptography as FIPS-approved or NIST-recommended algorithms", "quote": "approved cryptography: An encryption algorithm, hash function, random bit generator, or similar technique that is Federal Information Processing Standards (FIPS)-approved or NIST-recommended. Approved algorithms and techniques are either specified or adopted in a FIPS or NIST recommendation.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST SP 800-63B-4 distinguishes between approved algorithms and FIPS140-validated implementations for general users", "quote": "Authenticators used at AAL1 SHALL use approved cryptography. In other words, they must use approved algorithms, but the implementation need not be validated under [FIPS140].", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST requires FIPS140 Level 1 validation for verifiers operated by federal agencies", "quote": "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL1 SHALL be validated to meet the requirements of [FIPS140] Level 1.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}]}