Single on NIST SP 800-63B password rules, current revision

Perfect! I have found all the requirements. Now let me compile the exact quotes from the current revision of NIST SP 800-63B-4. Let me verify the exact wording by reviewing the text I retrieved.

Based on my research of NIST SP 800-63B-4 (the current revision), here are the password requirements:

Summary of Findings

I found all the password requirements for verifiers and credential service providers in Section 3.1.1 of NIST SP 800-63B-4. The document clearly specifies requirements for:

1. Single-factor minimum length: 15 characters (using SHALL)
2. Maximum length: 64 characters (using SHOULD)
3. Composition rules: Explicitly prohibited (using SHALL NOT)
4. Periodic password change: Explicitly prohibited (using SHALL NOT)
5. Password hints: Explicitly prohibited (using SHALL NOT)
6. Security questions: Explicitly prohibited (using SHALL NOT)
7. Blocklist checking: Required (using SHALL)
8. Password managers: Required to be allowed (using SHALL)
9. Salt length: 32 bits minimum (using SHALL)
10. Hashing scheme: Approved scheme from SP 800-132 (using SHOULD)

Here is the detailed JSON response:

{"answers":[{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., \"What was the name of your first pet?\") or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}]}