Plan-execute-verify on OWASP vs NIST on password hashing

I couldn't find a real conflict between the two sources. For the parts of the service that fall under FIPS, use PBKDF2-HMAC-SHA-256 from a FIPS 140-validated module. Set at least 600,000 iterations and add a per-password salt. Ideally, also add a keyed hashing step with a secret key held in an HSM. Argon2id, which OWASP ranks first, is only an option for code outside FIPS scope.

What OWASP recommends (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)

• Order of preference:

  1. Argon2id, with at least 19 MiB of memory, 2 iterations and parallelism 1.
  2. scrypt if Argon2id isn't available, with N=2^17, r=8, p=1.
  3. bcrypt only for legacy systems, with a work factor of at least 10 and passwords capped at 72 bytes.
• FIPS: if FIPS-140 compliance is required, OWASP says to use PBKDF2 with HMAC-SHA-256 and at least 600,000 iterations. It says PBKDF2 should be preferred "since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations."
• Other iteration counts: 220,000 for PBKDF2-HMAC-SHA512. PBKDF2-HMAC-SHA1 is legacy only, and OWASP says NIST SP 800-131A Rev. 2 disallows SHA-1 for new use after 2030.
• Pepper: OWASP suggests "considering" a pepper for defense in depth, kept in a secrets vault or HSM. It notes that a pepper adds no security on its own.

What NIST SP 800-63B-4 requires (https://pages.nist.gov/800-63-4/sp800-63b.html)

• Which revision is current: Rev. 4 says it supersedes SP 800-63B. The Rev. 3 page says it was replaced by SP 800-63-4 "as of August 1, 2025" (https://pages.nist.gov/800-63-3/sp800-63b.html). The CSRC page suggested in the plan (https://csrc.nist.gov/pubs/sp/800/63/b/4/final) returned a 404, so I took the date from that Rev. 3 banner.

• Storage requirements (SHALL):

  • Store passwords in a form that resists offline attacks.
  • Salt and hash them with "a suitable password hashing scheme."
  • Use a salt of at least 32 bits, and store the salt and the hash for every password.

• Recommendations (SHOULD):

  • Set the cost factor "as high as practical" and raise it over time.
  • Use "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes."
  • Store a reference to the scheme and cost factor so you can migrate later.
  • Run an extra keyed hashing or encryption step with a secret key known only to the verifier. If you do, the key SHALL come from an approved random bit generator and be stored apart from the hashes. It SHOULD be kept in an HSM or a trusted execution environment.
• Algorithms: Rev. 4 names none. The words "PBKDF2" and "memory-hard" don't appear anywhere in it. It points only to SP 800-132, which its reference list gives as the 2010 "Recommendation for Password-Based Key Derivation."
• The FIPS link: federal verifiers at AAL1 and AAL2 SHALL use cryptography validated to FIPS 140 Level 1. That means implementations validated by NIST's Cryptographic Module Validation Program (CMVP).

How the two differ

1. Which algorithm comes first. OWASP puts Argon2id first. NIST Rev. 4 names no algorithm and just refers to "approved" schemes in SP 800-132.
2. Whether PBKDF2 is named. OWASP says PBKDF2 is "permitted by NIST SP 800-63B-4", but Rev. 4 never names it. That statement is OWASP's reading of the SP 800-132 reference. I couldn't open SP 800-132 itself (its CSRC page returned 404), so I can't confirm from the source that it defines PBKDF2.
3. Memory-hard functions and iteration counts. Rev. 3 named PBKDF2 and Balloon. It also said a memory-hard function SHOULD be used and suggested "typically at least 10,000 iterations." Rev. 4 drops all three points. OWASP's 600,000 is much higher than the old Rev. 3 figure, and Rev. 4 sets no number.
4. Strength of the pepper advice. NIST makes the keyed step a SHOULD and wants the key in an HSM or TEE. OWASP only says to "consider" a pepper.

How to reconcile them
Inside FIPS scope, use PBKDF2-HMAC-SHA-256 with at least 600,000 iterations, or PBKDF2-HMAC-SHA-512 with at least 220,000. It must come from a CMVP-validated module, and you should not use SHA-1. Use a random per-password salt of at least 32 bits and store it next to the hash. Store the scheme and cost too, so you can raise the cost later. Add the keyed step with a key from an approved random bit generator, kept separately and ideally in an HSM.

This meets NIST's SHALLs, follows its SHOULD to use an SP 800-132 scheme, and matches OWASP's FIPS advice. I didn't find a NIST source saying outright that Argon2id or scrypt are "not approved." The basis for keeping them outside FIPS scope is that Rev. 4 doesn't name them, it points only to SP 800-132, and OWASP itself gives PBKDF2 as the FIPS option.

{"evidence": [
{"claim": "OWASP's first choice is Argon2id with minimum parameters of 19 MiB memory, 2 iterations and parallelism 1.", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP's second choice, when Argon2id isn't available, is scrypt.", "quote": "If Argon2id is not available, use scrypt with a minimum CPU/memory cost parameter of (2^17), a minimum block size of 8 (1024 bytes), and a parallelization parameter of 1.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP limits bcrypt to legacy systems, with a work factor of at least 10 and a 72-byte password limit.", "quote": "For legacy systems using bcrypt, use a work factor of 10 or more and with a password limit of 72 bytes.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP says to use PBKDF2-HMAC-SHA-256 with at least 600,000 iterations when FIPS-140 compliance is required.", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP describes PBKDF2 as permitted by SP 800-63B-4 and available in FIPS-140 validated implementations.", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP's PBKDF2-HMAC-SHA512 iteration count is 220,000.", "quote": "PBKDF2-HMAC-SHA512: 220,000 iterations", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP says peppers are secrets to keep in vaults or HSMs.", "quote": "Peppers are secrets and should be stored in \"secrets vaults\" or HSMs (Hardware Security Modules).", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "SP 800-63B-4 supersedes the earlier SP 800-63B.", "quote": "This publication supersedes NIST Special Publication (SP) 800-63B.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "The Rev. 3 page says it was superseded by SP 800-63-4 on August 1, 2025.", "quote": "This revision of NIST SP 800-63 has been superseded by NIST SP 800-63-4 as of August 1, 2025.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"},
{"claim": "SP 800-63B-4 requires passwords to be salted and hashed with a suitable password hashing scheme.", "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 recommends an approved hashing scheme from SP 800-132 and names no specific algorithm.", "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 says the cost factor should be as high as practical.", "quote": "The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 requires a salt of at least 32 bits.", "quote": "The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 recommends an extra keyed hashing or encryption step using a secret key.", "quote": "In addition, verifiers SHOULD perform an additional iteration of a keyed hashing or encryption operation using a secret key known only to the verifier.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 says the secret key should be kept in an HSM or TEE.", "quote": "It SHOULD be stored and used within a hardware-protected area, such as a hardware security module or trusted execution environment (TEE), such as a trusted platform module (TPM).", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 requires federal verifiers at AAL2 to use FIPS 140 Level 1 validated cryptography.", "quote": "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL2 SHALL be validated to meet the requirements of [FIPS140] Level 1 unless otherwise specified.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 says FIPS 140 is satisfied by CMVP-validated cryptography.", "quote": "Throughout this document, [FIPS140] requirements are satisfied by security technologies, products, and services that utilize implementations of cryptography validated by the Cryptography Module Validation Program [CMVP].", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "The superseded Rev. 3 named PBKDF2 and Balloon, while Rev. 4 does not mention PBKDF2.", "quote": "Examples of suitable key derivation functions include Password-based Key Derivation Function 2 (PBKDF2) [SP 800-132] and Balloon [BALLOON].", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"},
{"claim": "The superseded Rev. 3 suggested about 10,000 PBKDF2 iterations, far fewer than OWASP's 600,000.", "quote": "Therefore, the iteration count SHOULD be as large as verification server performance will allow, typically at least 10,000 iterations.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"}
]}