Single on OWASP vs NIST on password hashing

I've read the OWASP cheat sheet and the NIST SP 800-63B-4 page, so I'm writing up the comparison now.

What OWASP recommends

OWASP's Password Storage Cheat Sheet gives a ranked list. The first choice is Argon2id, with at least 19 MiB of memory, 2 iterations and 1 degree of parallelism. If Argon2id isn't available, it says to use scrypt. It allows bcrypt for legacy systems. For FIPS it has a separate rule: "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256." Its PBKDF2 section says PBKDF2 should be the preferred algorithm when FIPS-validated implementations are required. It gives these iteration counts:

• PBKDF2-HMAC-SHA256: 600,000
• PBKDF2-HMAC-SHA512: 220,000
• PBKDF2-HMAC-SHA1: 1,400,000, which it marks as legacy

Source: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

What NIST SP 800-63B-4 requires

I read the current revision, 800-63B-4, at https://pages.nist.gov/800-63-4/sp800-63b.html. The page text I retrieved had no "Final" status label, so I'm relying on the title and the OWASP sheet's reference to 800-63B-4. Section 3.1.1.2 sets these requirements:

• Salting and hashing (SHALL): passwords must be salted and hashed with "a suitable password hashing scheme."
• Salt (SHALL): at least 32 bits, chosen to minimize collisions. Both the salt and the hash must be stored.
• Cost factor (SHOULD): as high as practical without hurting verifier performance, and increased over time.
• Scheme choice (SHOULD): an approved scheme from the latest revision of SP 800-132 or from updated NIST guidance.
• Keyed hash (SHOULD): an additional iteration of a keyed hash or encryption using a secret key held only by the verifier. The key should be stored separately, ideally in an HSM or TEE.

My searches of the page found no mention of PBKDF2 or Argon2id. The only "Argon" hit was the word "jargon." So 800-63B-4 doesn't name a specific algorithm. It defers to SP 800-132, which I did not open. I'm therefore not claiming from a source I read what SP 800-132 contains.

How to reconcile them

The two sources don't actually conflict. NIST sets the requirements, and OWASP supplies concrete choices.

1. Under FIPS, use PBKDF2-HMAC-SHA256 with at least 600,000 iterations. This is OWASP's FIPS-specific advice, and OWASP says PBKDF2 is permitted by 800-63B-4. Use a FIPS 140-validated cryptographic module. OWASP says such implementations exist for PBKDF2.
2. Argon2id is OWASP's first choice, but I found no source in this session showing it is NIST-approved or FIPS-validated. If FIPS compliance is mandatory, don't use it as the primary scheme. I'd consider it only if the compliance scope permits.

3. Meet the NIST items that don't depend on the algorithm:

   • a salt of at least 32 bits, and in practice a longer random one
   • a stored record of the scheme and cost factor, so you can migrate later
   • a cost factor that you raise over time
   • a secret key (pepper) for an extra keyed-hash step, stored in an HSM or vault, separate from the database
4. Confirm the exact approval status with your compliance assessor, because NIST says the approved list lives in SP 800-132 or in later NIST guidance.

Both sources recommend a pepper. OWASP says it adds defense in depth, and NIST says to add a keyed-hash iteration.

{"evidence": [
{"claim": "OWASP recommends Argon2id as the primary choice, with minimum parameters.", "quote": "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP's FIPS-specific recommendation is PBKDF2 with at least 600,000 iterations and HMAC-SHA-256.", "quote": "If FIPS-140 compliance is required, use PBKDF2 with a work factor of 600,000 or more and set with an internal hash function of HMAC-SHA-256.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "OWASP says PBKDF2 is permitted by NIST SP 800-63B-4, has FIPS-validated implementations, and should be preferred when those are required.", "quote": "Since PBKDF2 is permitted by NIST SP 800-63B-4 and has FIPS-140 validated implementations, it should be the preferred algorithm when these are required.", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"},
{"claim": "NIST 800-63B-4 requires salted hashing with a suitable password hashing scheme.", "quote": "Passwords SHALL be salted and hashed using a suitable password hashing scheme.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST defers the choice of approved scheme to SP 800-132 or updated NIST guidance, and does not name a specific algorithm in this document.", "quote": "An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST requires a salt of at least 32 bits and storing both salt and hash.", "quote": "The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST recommends a high, increasing cost factor.", "quote": "The chosen cost factor SHOULD be as high as practical without negatively impacting verifier performance.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"claim": "NIST recommends an additional keyed-hash iteration with a secret key stored separately from the hashes.", "quote": "In addition, verifiers SHOULD perform an additional iteration of a keyed hashing or encryption operation using a secret key known only to the verifier.", "url": "https://pages.nist.gov/800-63-4/sp800-63b.html"}
]}