Plan-execute-verify on NIST SP 800-63B password rules, current revision

In the current revision (Rev. 4), SP 800-63B sets requirements for all ten topics. I read them on the official NIST page, https://pages.nist.gov/800-63-4/sp800-63b.html. The relevant text is in §3.1.1.1 (Password Authenticators) and §3.1.1.2 (Password Verifiers). I did not open Rev. 3, so I haven't compared it with the earlier text.

• Minimum length: Passwords used as the only factor SHALL be at least 15 characters. Passwords used only as part of multi-factor authentication MAY be shorter, but SHALL be at least 8 characters.
• Maximum length: Verifiers SHOULD permit at least 64 characters. This is a SHOULD, not a SHALL.
• Composition rules, periodic change, hints and security questions: All four are SHALL NOT. The one exception is that a verifier SHALL force a change if the authenticator may be compromised.
• Blocklist: Verifiers SHALL compare a new password against a blocklist of commonly used, expected or compromised passwords.
• Password managers: Verifiers SHALL allow password managers and autofill.
• Salt: The salt SHALL be at least 32 bits.
• Hashing scheme: This is only a SHOULD. The page says an approved scheme from the latest revision of SP 800-132 "SHOULD be used". Separately, passwords SHALL be salted and hashed with a suitable password hashing scheme.

{"answers":[
{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}
]}