Orchestrator-workers on NIST SP 800-63B password rules, current revision

NIST SP 800-63B-4 (Revision 4) sets out these password requirements in section 3.1.1.2, "Password Verifiers". All three workers read the same page, https://pages.nist.gov/800-63-4/sp800-63b.html, and their quotes and keywords agree on all ten topics.

Caveats from the workers' reports:

• The page is dated 26 Aug 2025, and its abstract says "This publication supersedes NIST Special Publication (SP) 800-63B." The page has no explicit "Final" label, and nobody opened the nvlpubs.nist.gov PDF to confirm status. I am treating Rev 4 as current because of the supersession statement.
• Nobody opened the Revision 3 text, so I can't say whether it differs. The workers found no conflicts within the Rev 4 page.
• Maximum length is a SHOULD, and 64 is a floor ("at least 64 characters"), not a cap.
• Hashing scheme is only a SHOULD. A separate sentence, "Passwords SHALL be salted and hashed using a suitable password hashing scheme", is a SHALL, but it doesn't name SP 800-132. One worker reported it, and I haven't included it in the JSON.
• The 15-character minimum applies to single-factor use. One worker noted that passwords used only within multi-factor authentication may be shorter, with a minimum of 8. That detail is reported by one worker, and I haven't included its quote.
• One worker also noted the periodic-change prohibition is paired with a requirement to force a change on evidence of compromise.

{"answers":[
{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}
]}