Single on OWASP vs NIST on password hashing

Now I have comprehensive information from both sources. Let me write the complete answer.

Answer

A team choosing a password hashing algorithm must balance security best practices with federal compliance requirements. Here's what the current guidance from each source actually says:

OWASP Password Storage Guidance

OWASP's Password Storage Cheat Sheet provides a clear hierarchy of recommendations based on availability and compliance needs:

1. Primary recommendation: Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism. This memory-hard algorithm is preferred because it resists both GPU-based and side-channel attacks.
2. Acceptable alternative: If Argon2id is unavailable, use scrypt with a minimum CPU/memory cost parameter of (2^17), a minimum block size of 8 (1024 bytes), and a parallelization parameter of 1.
3. Legacy systems: For older systems, bcrypt remains acceptable with a work factor of 10 or more, though with a 72-byte password limit.
4. FIPS-140 compliance: Crucially, when FIPS-140 compliance is required, OWASP specifies using PBKDF2 with a work factor of 600,000 or more iterations, combined with HMAC-SHA-256 as the internal hash function. OWASP explicitly notes that "PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations."

NIST SP 800-63B-4 Requirements

The current revision (SP 800-63B-4) of NIST's Digital Identity Guidelines takes a more flexible but less prescriptive approach:

• Passwords "SHALL be salted and hashed using a suitable password hashing scheme."
• The document states that "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used."

NIST defines "approved cryptography" as algorithms that are either "Federal Information Processing Standards (FIPS)-approved or NIST-recommended." SP 800-132 (referenced by NIST) is the specification for PBKDF2.

Notably, NIST's earlier revision (SP 800-63B-3) explicitly stated that "A memory-hard function SHOULD be used because it increases the cost of an attack," mentioning PBKDF2 and Balloon as examples of suitable functions. This indicates NIST's openness to memory-hard algorithms beyond PBKDF2.

How to Reconcile the Two for FIPS Compliance

The reconciliation for teams needing FIPS compliance is straightforward:

1. If FIPS-140 compliance is required: Both sources agree on PBKDF2. OWASP recommends 600,000+ iterations with HMAC-SHA-256, and NIST references SP 800-132, which defines PBKDF2. PBKDF2 has validated FIPS-140 implementations, making it the bridge between security best practices and federal requirements.
2. If FIPS compliance is not required: OWASP's preference for Argon2id aligns with NIST's recognition that memory-hard functions "should be used" for increased attack cost. The "updated NIST guidelines on password hashing schemes" referenced in SP 800-63B-4 likely points toward future recognition of algorithms like Argon2, though these haven't been formally codified in a published NIST SP yet.
3. Key insight: The apparent tension resolves because PBKDF2 is simultaneously a FIPS-approved algorithm (meeting the FIPS requirement) and acceptable under NIST guidelines (listed in SP 800-132 that NIST references). Teams requiring federal compliance can use PBKDF2 with appropriate work factors and satisfy both OWASP security principles and NIST requirements.

{"evidence": [
  {
    "claim": "OWASP recommends Argon2id with minimum 19 MiB of memory, iteration count 2, and 1 degree of parallelism",
    "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP recommends PBKDF2 with 600,000 iterations and HMAC-SHA-256 for FIPS-140 compliance",
    "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "OWASP notes that PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations",
    "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.",
    "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
  },
  {
    "claim": "NIST SP 800-63B-4 requires passwords to be salted and hashed using a suitable password hashing scheme",
    "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-4 allows approved schemes from SP800-132 or updated NIST guidelines",
    "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.",
    "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
    "claim": "NIST SP 800-63B-3 explicitly recommended memory-hard functions for password hashing",
    "quote": "A memory-hard function SHOULD be used because it increases the cost of an attack.",
    "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"
  }
]}