Propose-select on OWASP vs NIST on password hashing

Complete Answer

OWASP Password Storage Guidance

OWASP's Password Storage Cheat Sheet provides the following recommendations for password hashing algorithms:

1. Primary recommendation (Argon2id): Use Argon2id with a minimum configuration of 19 MiB of memory, 2 iterations, and 1 degree of parallelism.
2. Secondary recommendation (scrypt): If Argon2id is unavailable, use scrypt with CPU/memory cost parameter 2^17, block size of 8 (1024 bytes), and parallelization parameter of 1.
3. Legacy systems (bcrypt): For legacy systems, use bcrypt with a work factor of 10 or more and password limit of 72 bytes.
4. FIPS-140 compliance (PBKDF2): When FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more iterations and an internal hash function of HMAC-SHA-256.

OWASP explicitly states: "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required."

NIST SP 800-63B-4 Requirements

The current revision (800-63B-4) provides less prescriptive but still concrete guidance. NIST SP 800-63B Revision 3 was superseded by NIST SP 800-63B-4 as of August 1, 2025.

Verifiers "SHALL store passwords in a form that is resistant to offline attacks. Passwords SHALL be salted and hashed using a suitable password hashing scheme." The requirement further states: "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used."

NIST SP 800-63B-4 specifies:

• Salt must be at least 32 bits in length and chosen to minimize collisions
• Cost factor should be as high as practical without negatively impacting verifier performance
• Cost factor should be increased over time to account for computing performance improvements
• Verifiers SHOULD perform an additional iteration using a secret key (pepper) stored separately from hashed passwords

The Reconciliation: OWASP and NIST with FIPS-140

The apparent tension between OWASP's preference for Argon2 and FIPS-140 compliance is resolved by algorithm choice based on regulatory requirements:

When FIPS-140 is NOT required: Teams should follow OWASP's primary recommendations—Argon2id is the best choice because it is memory-hard and more resistant to GPU and ASIC attacks than PBKDF2.

When FIPS-140 IS required: Teams must use PBKDF2 with HMAC-SHA-256 and at least 600,000 iterations (per OWASP) because:

• Argon2 does not have FIPS-140 validated implementations
• PBKDF2 is specified in NIST SP 800-132 (referenced by NIST SP 800-63B-4)
• PBKDF2 has widely available FIPS-140 validated implementations
• PBKDF2 meets the NIST SP 800-63B-4 requirement for using "an approved password hashing scheme"

Both sources agree on the fundamentals: use salted hashing with appropriate cost/work factors that slow down password cracking attacks. The key difference is simply which algorithms can be formally validated to FIPS-140 standards.

{"evidence": [
  {
    "claim": "OWASP recommends Argon2id as the primary password hashing algorithm",
    "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP recommends PBKDF2 specifically for FIPS-140 compliance",
    "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP explicitly states PBKDF2 is preferred when FIPS-140 and NIST SP 800-63B-4 compliance are both required",
    "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "NIST SP 800-63B-4 requires passwords to be salted and hashed using a suitable password hashing scheme",
    "quote": "Verifiers SHALL store passwords in a form that is resistant to offline attacks. Passwords SHALL be salted and hashed using a suitable password hashing scheme.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-4 references approved password hashing schemes from SP 800-132 or updated NIST guidelines",
    "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-4 requires minimum 32-bit salt and increasing cost factors over time",
    "quote": "The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password). The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance. It SHOULD be increased over time to account for increases in computing performance.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B Revision 3 recommended PBKDF2 and memory-hard functions",
    "quote": "Examples of suitable key derivation functions include Password-based Key Derivation Function 2 (PBKDF2) [SP 800-132] and Balloon [BALLOON]. A memory-hard function SHOULD be used because it increases the cost of an attack.",
    "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"
  }
]}