Propose-select on OWASP vs NIST on password hashing

The team should use PBKDF2 with HMAC-SHA-256 at 600,000 or more iterations, run inside a crypto module validated under FIPS 140. Each password gets a unique salt of at least 32 bits. Add a secret-key step on top (an HMAC, often called a "pepper") with the key kept apart from the database. OWASP and NIST don't conflict on this. OWASP's general first choice is Argon2id, but it names PBKDF2 for exactly this FIPS case, and PBKDF2 also meets NIST SP 800-63B-4.

What OWASP recommends

Source: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

• General order of preference:

  • Argon2id first: "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism."
  • scrypt if Argon2id isn't available.
  • bcrypt only in legacy systems (work factor 10 or more, 72-byte input limit).

• When FIPS applies:

  • "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256."
  • PBKDF2 "should be the preferred algorithm when these are required," because it "is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations."

• Other settings:

  • Iteration counts: 600,000 for PBKDF2-HMAC-SHA256 and 220,000 for HMAC-SHA512. HMAC-SHA1 is "legacy only."
  • These counts are dated December 2022 (GPU benchmarks).
  • A pepper is something to "consider."
  • Store the algorithm and work factor with each hash (for example in the PHC string format) so hashes can be upgraded later.
  • As a rule of thumb, computing one hash should take less than a second.

What NIST SP 800-63B-4 requires

Source: https://pages.nist.gov/800-63-4/sp800-63b.html

This is the current revision. The page says it "supersedes NIST Special Publication (SP) 800-63B."

SHALL (mandatory):

• Passwords "SHALL be salted and hashed using a suitable password hashing scheme."
• The salt must be at least 32 bits and chosen so that different accounts rarely end up with the same salt.
• The salt and the hash are stored for each password.
• If a secret key is used, it must come from an approved random bit generator and be stored separately from the hashes.
• Cryptography in verifiers run by or for federal agencies must be validated to FIPS 140, at least Level 1 at AAL1 and AAL2. "Validated" means the implementation is certified by NIST's Cryptographic Module Validation Program (CMVP).

SHOULD (recommended):

• "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used." SP 800-132 is listed in the references as the 2010 "Recommendation for Password-Based Key Derivation."
• Set the cost factor as high as practical and raise it over time.
• Store a reference to the scheme and cost factor with each password.
• Add an extra keyed hashing or encryption step, with the key ideally kept in an HSM or a TEE (secure hardware for keys).

What Rev. 4 does not say:

• It doesn't name PBKDF2, Argon2 or bcrypt, and it gives no iteration count.
• The PBKDF2 link comes from SP 800-132 and from the older Rev. 3 (https://pages.nist.gov/800-63-3/sp800-63b.html). Rev. 3 named "PBKDF2 [SP 800-132] and Balloon" as examples, said "A memory-hard function SHOULD be used," and suggested "typically at least 10,000 iterations." Those sentences aren't in Rev. 4, so don't quote Rev. 3's 10,000 figure as current NIST guidance.
• I couldn't open SP 800-132 itself, so the PBKDF2 link rests on the Rev. 3 text and OWASP's statement.

Where the two sources differ

• Algorithm: OWASP generally prefers memory-hard Argon2id. NIST Rev. 4 points to SP 800-132.
• How firm the rule is: under Rev. 4, using an "approved" scheme is a SHOULD, so Rev. 4 alone doesn't forbid Argon2id. The push toward PBKDF2 comes from FIPS 140 validation, which Rev. 4 requires for federal-agency verifiers and which OWASP ties to PBKDF2's validated implementations. The sources I opened don't say whether Argon2id is FIPS-approved, so I make no claim either way.
• Pepper: NIST makes the keyed step a SHOULD; OWASP only says "consider."
• Iterations: NIST gives no number. The 600,000 figure is OWASP's own December 2022 benchmark.

Plan, in order

1. Confirm whether the verifier is run by or for a federal agency. If so, its cryptography must be FIPS 140 / CMVP validated.
2. Use PBKDF2-HMAC-SHA256 from a validated module at 600,000 or more iterations. Tune it on your own hardware so one hash stays under a second. Don't use HMAC-SHA1.
3. Generate a unique random salt of at least 32 bits for each password. Store the salt, the hash, and the scheme and cost factor (for example as a PHC-style string).
4. Add the keyed step: a separate HMAC whose key comes from an approved random bit generator and is kept in an HSM or TEE, away from the database.
5. Plan to raise the cost over time by re-hashing passwords when users log in. Watch for any revision of SP 800-132.
6. For parts of the system outside FIPS scope, OWASP's general choice is Argon2id. Rev. 4 doesn't ban it, but it isn't the "approved" scheme Rev. 4 points to.

{"evidence": [
{"claim": "OWASP's default recommendation is Argon2id with specific minimum parameters.", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP recommends PBKDF2-HMAC-SHA-256 at 600,000+ iterations when FIPS-140 compliance is required.", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP says PBKDF2 should be preferred when NIST/FIPS requirements apply.", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP restricts bcrypt to legacy systems.", "quote": "The bcrypt password hashing function should only be used for password storage in legacy systems where Argon2 and scrypt are not available.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP's iteration figures are dated December 2022 benchmarks.", "quote": "These configuration settings are equivalent in the defense they provide. (Number as of december 2022, based on testing of RTX 4000 GPUs)", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP says a hash calculation should generally take less than one second.", "quote": "As a general rule, calculating a hash should take less than one second.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "SP 800-63B-4 supersedes the earlier SP 800-63B.", "quote": "This publication supersedes NIST Special Publication (SP) 800-63B.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 mandates salting and hashing passwords with a suitable password hashing scheme.", "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 recommends (SHOULD) an approved scheme from the latest SP 800-132 or updated NIST guidance.", "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "The SP 800-132 referenced by 800-63B-4 is NIST's 2010 password-based key derivation recommendation.", "quote": "[SP800-132] Turan M, Barker E, Burr W, Chen L (2010) Recommendation for Password-Based Key Derivation.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 requires salts of at least 32 bits that minimize collisions.", "quote": "The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 says the cost factor should be as high as practical.", "quote": "The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 recommends storing the scheme and cost factor per password to allow migration.", "quote": "A reference to the password hashing scheme used, including the cost factor, SHOULD be stored for each password to allow migration to new algorithms and work factors.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 recommends an additional keyed hashing step with a verifier-only secret key.", "quote": "In addition, verifiers SHOULD perform an additional iteration of a keyed hashing or encryption operation using a secret key known only to the verifier.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 requires the secret key to be stored apart from the hashes.", "quote": "The secret key value SHALL be stored separately from the hashed passwords.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "SP 800-63B-4 requires FIPS 140 validation for cryptography in federal-agency verifiers.", "quote": "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL1 SHALL be validated to meet the requirements of [FIPS140] Level 1.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "FIPS 140 requirements are satisfied by CMVP-validated implementations.", "quote": "Throughout this document, [FIPS140] requirements are satisfied by security technologies, products, and services that utilize implementations of cryptography validated by the Cryptography Module Validation Program [CMVP].", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "The superseded Rev. 3 named PBKDF2 and Balloon as suitable KDFs.", "quote": "Examples of suitable key derivation functions include Password-based Key Derivation Function 2 (PBKDF2) [SP 800-132] and Balloon [BALLOON].", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"},
{"claim": "Rev. 3 recommended memory-hard functions.", "quote": "A memory-hard function SHOULD be used because it increases the cost of an attack.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"},
{"claim": "Rev. 3 gave an iteration guideline of typically at least 10,000, which Rev. 4 dropped.", "quote": "Therefore, the iteration count SHOULD be as large as verification server performance will allow, typically at least 10,000 iterations.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"}
]}