Single on OWASP vs NIST on password hashing

Now I have enough information to provide a comprehensive answer. Let me gather the key quotes for the evidence section.

Based on my research, I can now provide you with a complete answer about password hashing algorithm recommendations for US federal compliance.

Answer

OWASP Password Storage Guidance:

OWASP's Password Storage Cheat Sheet recommends a tiered approach depending on requirements and constraints. The primary recommendation is Argon2id with minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism. For systems without Argon2id support, OWASP recommends scrypt with specific parameters (minimum CPU/memory cost parameter of 2^17, minimum block size of 8, and parallelization parameter of 1). For legacy systems, bcrypt with a work factor of 10 or more is acceptable. Critically, OWASP explicitly states: "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256."

Current NIST SP 800-63B Requirement:

The current revision of NIST SP 800-63B is revision 4 (800-63B-4), which superseded revision 3 as of August 1, 2025. NIST SP 800-63B-4 requires that "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used." The standard requires that "The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance" and "It SHOULD be increased over time to account for increases in computing performance."

NIST SP 800-132 is the "Recommendation for Password-Based Key Derivation" published in 2010, which specifies PBKDF2 (Password-Based Key Derivation Function 2).

How to Reconcile the Two:

The reconciliation is straightforward and explicitly addressed in OWASP's guidance. OWASP itself explains the reconciliation by stating that "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required." The key constraint is that PBKDF2 is the only algorithm among the modern recommendations that has FIPS-140 validated implementations.

Therefore, for a team that must satisfy both OWASP security best practices and US federal FIPS-140 requirements, the answer is clear: use PBKDF2 with HMAC-SHA-256 and a work factor of 600,000 iterations. This meets OWASP's explicit FIPS-140 compliance guidance and satisfies NIST SP 800-63B-4's requirements by using an approved password hashing scheme from SP 800-132.

If FIPS-140 compliance is not required, the team should follow OWASP's preferred recommendations and use Argon2id, as it provides superior security properties through memory-hard algorithms that resist GPU and ASIC attacks more effectively than PBKDF2. However, the FIPS-140 constraint eliminates this option for federal systems, leaving PBKDF2 as the only practical choice among the recommended algorithms.

{"evidence": [{"claim": "OWASP recommends using Argon2id as the primary password hashing algorithm with specific minimum parameters", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "OWASP recommends using PBKDF2 with 600,000 iterations of HMAC-SHA-256 when FIPS-140 compliance is required", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}, {"claim": "The current NIST standard SP 800-63B-4 requires using an approved password hashing scheme published in SP 800-132 or updated NIST guidelines", "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "NIST SP 800-63B-4 requires the cost factor to be as high as practical and increased over time", "quote": "The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance. It SHOULD be increased over time to account for increases in computing performance.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}, {"claim": "PBKDF2 is the reconciling choice because it has FIPS-140 validated implementations and is permitted by NIST SP 800-63B-4", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"}]}