Orchestrator-workers on OWASP vs NIST on password hashing

Summary

OWASP recommends Argon2id first. For systems that must meet FIPS-140, its own cheat sheet says to use PBKDF2 instead. NIST SP 800-63B Revision 4, the current revision, names no algorithm at all. It requires salted hashing with "a suitable password hashing scheme" and points to SP 800-132 or later NIST guidance for approved schemes. A FIPS-bound team can therefore follow OWASP's FIPS branch: PBKDF2-HMAC-SHA-256 at 600,000 or more iterations, run in a FIPS 140-validated cryptographic module. Several parts of this rest on sources nobody could open, so treat those as unconfirmed.

What OWASP says

Source: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

• First choice: Argon2id with at least 19 MiB of memory, 2 iterations and parallelism 1. The detailed section lists equivalent settings that trade memory against CPU, from 46 MiB with t=1 down to 7 MiB with t=5.
• Fallback: scrypt if Argon2id is unavailable, with N=2^17, r=8, p=1 as the top setting.
• Legacy: bcrypt only where Argon2 and scrypt are not available, with a work factor of at least 10 and a 72-byte password limit.

• FIPS-140: PBKDF2 with a work factor of 600,000 or more and HMAC-SHA-256 inside.

  • Other counts: 220,000 for HMAC-SHA-512, and 1,400,000 for HMAC-SHA-1, which is legacy only.

• Salt, pepper and upgrades:

  • Each password gets a unique salt, which libraries usually manage.
  • A pepper is optional, stored outside the database.
  • Work factors are raised by re-hashing at login, with old and new hashes coexisting during the transition.

The page is slightly inconsistent about ordering. Its introduction lists "Argon2id, bcrypt, or PBKDF2", while its summary orders Argon2id, scrypt, then bcrypt, with PBKDF2 as the FIPS option.

What NIST SP 800-63B requires

Source for Revision 4: https://pages.nist.gov/800-63-4/sp800-63b.html

Which revision is current. Revision 3 carries a banner saying it was superseded by SP 800-63-4 as of August 1, 2025 (https://pages.nist.gov/800-63-3/sp800-63b.html). Revision 4 states that it supersedes the earlier SP 800-63B. I did not find an exact publication date for the final document. The Revision 4 page shows a timestamp of 26 Aug 2025.

Revision 4 password storage rules (§3.1.1.2):

• Passwords SHALL be salted and hashed using a suitable password hashing scheme.
• An approved scheme from the latest SP 800-132, or from updated NIST guidance, SHOULD be used. This is a SHOULD, not a SHALL.
• The cost factor SHOULD be "as high as practical" and increased over time. No iteration number is given.
• The salt SHALL be at least 32 bits.
• The scheme and cost factor SHOULD be stored per password to allow migration.
• Verifiers SHOULD add a keyed hash or encryption step (a pepper). Its key must be stored separately from the hashes, ideally in an HSM or similar hardware.
• Related length rules: at least 15 characters for single-factor passwords and 8 for multi-factor. Verifiers must not truncate passwords.
• Federal verifiers at AAL2 must use cryptography validated to FIPS 140 Level 1.

Revision 3 differed. It named PBKDF2 and Balloon as examples, recommended a memory-hard function, and suggested typically at least 10,000 iterations. Revision 4 drops all three. Another worker's search of the Revision 4 page for "PBKDF2" and "Argon2" found no matches.

How to reconcile them

1. The two sources do not conflict. OWASP's default is Argon2id, but it carves out PBKDF2 explicitly when FIPS-140 is required. NIST's current text does not forbid any algorithm by name.

2. For a FIPS-bound service:

   • Use PBKDF2-HMAC-SHA-256 with at least 600,000 iterations.
   • Run it inside a FIPS 140-validated cryptographic module.
   • Use a random per-password salt, well above the 32-bit minimum.
   • Store the scheme and cost with each hash so you can raise the cost later.
   • Optionally add the NIST-described secret-key step, with the key in an HSM.
3. Where to use Argon2id. Use it where FIPS validation is not required.
4. Where the numbers come from. The 600,000 figure comes from OWASP, not NIST. NIST Revision 4 gives no count.

Caveats and gaps

• OWASP's attribution: OWASP says PBKDF2 "is permitted by NIST SP 800-63B-4". The Revision 4 text we saw never names PBKDF2. Any link therefore runs indirectly through SP 800-132.
• SP 800-132 not read: No worker could open SP 800-132 or any CMVP page, because csrc.nist.gov and nvlpubs.nist.gov URLs returned 404. SP 800-132's own iteration and salt minimums and its revision status are therefore unverified.
• Other algorithms not confirmed: I could not confirm from a NIST source whether Argon2, scrypt or bcrypt are approved or validated. The pages show only that NIST does not name them. OWASP does not say they lack validation either.
• Module validation: OWASP's claim that PBKDF2 has FIPS-140 validated implementations is unverified. Check the CMVP listing for the specific module you plan to use.

{"evidence": [
{"claim": "OWASP's summary recommendation is Argon2id with at least 19 MiB memory, 2 iterations, parallelism 1.", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP lists several equivalent Argon2id settings that trade CPU against RAM.", "quote": "These configuration settings provide an equal level of defense, and the only difference is a trade off between CPU and RAM usage.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "If Argon2id is unavailable, OWASP recommends scrypt.", "quote": "If Argon2id is not available, use scrypt with a minimum CPU/memory cost parameter of (2^17), a minimum block size of 8 (1024 bytes), and a parallelization parameter of 1.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP positions bcrypt as legacy-only.", "quote": "The bcrypt password hashing function should only be used for password storage in legacy systems where Argon2 and scrypt are not available.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP's FIPS-140 branch: PBKDF2 with 600,000+ iterations and HMAC-SHA-256.", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP justifies PBKDF2 by saying NIST SP 800-63B-4 permits it and FIPS-140 validated implementations exist.", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP gives a lower PBKDF2 iteration count for HMAC-SHA-512.", "quote": "PBKDF2-HMAC-SHA512: 220,000 iterations", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_SheetCheat_Sheet.html"},
{"claim": "OWASP says legacy hashes can be upgraded by re-hashing, with old and new algorithms coexisting during transition.", "quote": "During the transition period, allow for a mix of old and new hashing algorithms.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "Revision 3 of SP 800-63B was superseded by 800-63-4 as of August 1, 2025, so Revision 4 is current.", "quote": "This revision of NIST SP 800-63 has been superseded by NIST SP 800-63-4 as of August 1, 2025. Please refer to those documents for the current guidelines.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"},
{"claim": "Revision 4 supersedes the earlier SP 800-63B.", "quote": "This publication supersedes NIST Special Publication (SP) 800-63B.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "Revision 4 requires salted and hashed passwords using a suitable password hashing scheme.", "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "Revision 4 names no algorithm and defers to SP 800-132 or updated NIST guidance, as a SHOULD.", "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "Revision 4 gives no iteration number; cost should be as high as practical.", "quote": "The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "Revision 4 sets a 32-bit minimum salt.", "quote": "The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "Revision 4 recommends storing the scheme and cost factor per password to enable migration.", "quote": "A reference to the password hashing scheme used, including the cost factor, SHOULD be stored for each password to allow migration to new algorithms and work factors.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "Revision 4 recommends an additional keyed hash or encryption step (pepper).", "quote": "In addition, verifiers SHOULD perform an additional iteration of a keyed hashing or encryption operation using a secret key known only to the verifier.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "The pepper key must be stored separately from the hashes.", "quote": "The secret key value SHALL be stored separately from the hashed passwords.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "Federal verifiers at AAL2 must use FIPS 140 Level 1 validated cryptography.", "quote": "Cryptography used by verifiers operated by or on behalf of federal agencies at AAL2 SHALL be validated to meet the requirements of [FIPS140] Level 1 unless otherwise specified.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "Revision 3 named PBKDF2 and Balloon as examples and recommended a memory-hard function; Revision 4 dropped these.", "quote": "Examples of suitable key derivation functions include Password-based Key Derivation Function 2 (PBKDF2) [SP 800-132] and Balloon [BALLOON]. A memory-hard function SHOULD be used because it increases the cost of an attack.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"},
{"claim": "Revision 3 suggested typically at least 10,000 PBKDF2 iterations.", "quote": "Therefore, the iteration count SHOULD be as large as verification server performance will allow, typically at least 10,000 iterations.", "url": "https://pages.nist.gov/800-63-3/sp800-63b.html"}
]}

One URL in the evidence block above is mistyped: the SHA-512 entry reads Password_Storage_Cheat_SheetCheat_Sheet.html. The correct URL is https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html, the same page cited in the other OWASP entries.