NIST SP 800-63B password rules, current revision

What does the current revision of NIST SP 800-63B require of verifiers and credential service providers about passwords? For each topic below, give the normative keyword of the requirement and the number it sets, if any. - single-factor-minimum-length: minimum length of a password used as the only authentication factor (characters) - maximum-length: the maximum password length verifiers permit (characters) - composition-rules: imposing composition rules, such as requiring a mix of character types - periodic-change: requiring subscribers to change their passwords periodically - password-hints: letting subscribers store a password hint that unauthenticated claimants can see - security-questions: prompting for knowledge-based authentication or security questions when a password is chosen - blocklist: checking a new password against a blocklist of commonly used, expected or compromised passwords - password-managers: allowing password managers and autofill - salt-length: the length of the salt used when storing passwords (bits) - hashing-scheme: using an approved password hashing scheme from the latest revision of SP 800-132 Research this with the provided web tools. Report, for every topic: - keyword: the normative keyword the current requirement uses - value: the number the requirement sets (in characters or bits), or null when it sets none - quote: a sentence from the current revision of SP 800-63B that states the requirement, copied word for word (at least six words). - url: the URL of the page the quote comes from, which you opened with fetch_page. Write whatever explanation you like, then end the answer with one fenced JSON block of exactly this shape, with one entry per topic: ```json {"answers":[{"topic":"single-factor-minimum-length","keyword":"SHALL | SHALL NOT | SHOULD | SHOULD NOT | MAY","value":"…","quote":"<a sentence copied word for word>","url":"<the URL of that page, as you opened it>"}]} ``` Quotes are checked against the text of the page at their URL, so copy them exactly. The block must be valid JSON: write a double quote inside a string as \".

Research rules: - The `search` and `fetch_page` tools are your only access to the web. Any other browsing tool is unavailable. - Search snippets are previews, not sources. Open a page with `fetch_page` before relying on what it says. - Long pages arrive one window at a time. Continue with `offset`, or use `find` to jump to a phrase. - Cite the URL of every source you rely on, next to the claim it supports. - Never cite a URL you did not open with `fetch_page`. A citation to an unopened page is scored as a fabrication. - Quotes must be copied word for word from the page you cite; they are checked against the page text. - Quote only passages the tools have shown you in this session. A quote recalled from memory does not count, even when the page contains it. - When sources disagree, say so explicitly and attribute each position, instead of silently picking one.