ScaffoldBench

RunSonnet 5.5repeat 1

Plan-execute-verify on NIST SP 800-63B password rules, current revision

claude-sonnet-5-5__plan-execute-verify__research-nist-password-rules__r1

Score

1.000

passed
design ran as designed
Cost
$0.117
Latency
35.0s
setup 0.0s, grading 0.0s
Turns
13
Tool calls
8
Subagents
0
Tokens in / out
53k / 4.2k
30,508 read from cache

Did the design run?

every check held
  • Run completed: heldharness.run-completedThe environment was built, the architecture returned and grading finished, none of them throwing.
  • No API failures: heldharness.apiNo model call failed at the API.
  • Every call ended: heldharness.calls-endedEvery call ended with a result, or was stopped by the run's own limits.
  • No harness tool denied: heldharness.harness-toolsThe sandbox guard never denied a harness tool, nor a tool the session itself offered.
  • Tool servers connected: heldharness.mcp-connectedEvery tool server the harness gave a call was connected when the session started.
  • No foreign tool servers: heldharness.mcp-hermeticNo call loaded a tool server the harness did not give it.
  • Builtin tools: heldharness.builtin-toolsA check recorded with the run.
  • Structured replies arrived: heldharness.structured-outputEvery call that asked for structured output and ran to the end got it.
  • No silent fallbacks: heldharness.not-degradedNo phase fell back on a default (an empty plan, a default winner) instead of its output.
  • The plan was a plan: heldplan-execute-verify.planThe planner’s reply was read through its schema and held at least one step.
  • Every verdict was read: heldplan-execute-verify.verdictsEvery review round ended with a verdict read from the schema reply, not a default.
  • The loop did what its verdicts said: heldplan-execute-verify.loopEvery verdict that called for a revision got one, and nothing was revised without such a verdict.
  • Each call was shown the right tools: heldplan-execute-verify.toolsThe planner was shown no tools, the verifier the read-only ones, and the executor and reviser the full toolset.

Phases

Plan: 0.0s to 11.8s, finished, 0 tool calls, $0.021
Execute: 11.8s to 28.6s, finished, 5 tool calls, $0.057
Verify: 28.6s to 35.0s, finished, 3 tool calls, $0.039

Drawn from the phase records: timing and cost per call, no tool calls or messages.

PhaseDurationCostTurnsToolsModel
Plan11.8s$0.02120claude-sonnet-5-5
Execute16.8s$0.05765claude-sonnet-5-5
Verify6.4s$0.03953claude-sonnet-5-5

The call-by-call replay is not published for this run. Traces are large, so the repository keeps 9 of this run set’s 900 and leaves the rest out; the score, phases and final answer on this page come from the committed run record.

Runs you can replay

Record this cell yourself: npm run bench -- run --strategies plan-execute-verify --tasks research-nist-password-rules --models claude-sonnet-5-5 --repeats 1

Score breakdown

  • passtopic single-factor-minimum-length: minimum length of a password used as the only authentication factor (characters)
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic maximum-length: the maximum password length verifiers permit (characters)
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic composition-rules: imposing composition rules, such as requiring a mix of character types
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic periodic-change: requiring subscribers to change their passwords periodically
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic password-hints: letting subscribers store a password hint that unauthenticated claimants can see
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic security-questions: prompting for knowledge-based authentication or security questions when a password is chosen
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic blocklist: checking a new password against a blocklist of commonly used, expected or compromised passwords
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic password-managers: allowing password managers and autofill
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic salt-length: the length of the salt used when storing passwords (bits)
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic hashing-scheme: using an approved password hashing scheme from the latest revision of SP 800-132
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

Penalties

No penalties were applied.

Scorer metadata

corpus
{"version":2,"snapshot":"2026-10-01","hash":"0786c624b04f6c85e2ed8a55d4acedd99e4cf2c18632a0ebc22ee969fb3e2263","documents":4}
opened documents
["nist-sp800-63b-4"]
opened by role
{"primary":["nist-sp800-63b-4"]}
displayed share
{"nist-sp800-63b-4":0.0334,"nist-sp800-63b-3":0.0014,"owasp-authentication":0.0068,"owasp-password-storage":0.0129}
cited count
1
verified count
1
hallucinated count
0
citation integrity
1
hallucinated urls
[]
answer block
true
answer block repaired
false
items answered
10
item count
10
field accuracy
1
grounded items
10
field misses
{}

Final answer

Per the current text, hashing scheme uses SHOULD. The 800-63B-4 page shows the final revision.

I read the password section (3.1.1.2, "Password Verifiers") of the current revision, NIST SP 800-63B-4. The source is https://pages.nist.gov/800-63-4/sp800-63b.html. I did not open a second source, so I have no cross-check.

  • Single-factor minimum length: SHALL, 15 characters. Passwords used only as part of multi-factor authentication may be shorter, but they SHALL still be at least 8 characters.
  • Maximum length: SHOULD, 64 characters. Verifiers SHOULD permit at least that many.
  • Composition rules: SHALL NOT. The page sets no number.
  • Periodic change: SHALL NOT. The exception is that verifiers SHALL force a change if there is evidence of compromise.
  • Password hints: SHALL NOT. This covers hints that an unauthenticated claimant can see.
  • Security questions and KBA: SHALL NOT. This applies when subscribers are choosing passwords.
  • Blocklist: SHALL. The entire password is compared against the list.
  • Password managers and autofill: SHALL. The separate "paste" requirement is only SHOULD.
  • Salt length: SHALL, at least 32 bits.
  • Hashing scheme: SHOULD. The text says an approved scheme from the latest SP 800-132 "or updated NIST guidelines on password hashing schemes SHOULD be used". Passwords SHALL be salted and hashed with a "suitable" scheme, but the approved-scheme wording itself is SHOULD.
{"answers":[{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}]}

Provenance of the numbers on this page

run set
scaffold-or-scale-v1
models
Haiku 4.5, Sonnet 5.5, Opus 5.5
effort
high
repeats
2
fixtures
replay
runs
900 / 900
strategy cost
$354.44
judge cost
$9.19
wall clock
9h 48m
git
fce5807b2d

Cost excludes judge calls, which are tracked separately so a scoring model never flatters or penalises an architecture. Every figure on this site is read from results/ at build time.