Articles and posts such as “Don’t Change Them Periodically”: NIST Releases 2nd Public Draft of Password Policy Guidelines have been circulating, creating the impression that prohibiting periodic password changes is new. Let me point out that this was already the case as of the June 2017 issuance of NIST SP 800-63, in its 3rd edition. It is not new. The same applies to restrictions on password character composition.
According to the NIST SP 800-63B-4 2pd guidelines, password requirements include the following:
- Length: Passwords must be at least 8 characters long, with a recommended minimum length of 15 characters. The maximum permitted password length must be at least 64 characters.
- Accepted characters: ASCII printable characters, spaces, and Unicode characters should be accepted. Each Unicode code point is counted as 1 character when evaluating password length.
- Composition rules: Composition rules, such as requiring a mixture of specified character types, should not be imposed.
- Blocklist: Passwords must be compared against commonly used, expected, or compromised passwords. The comparison should be made against the entire password, not substrings.
- Storage: Passwords must be stored using a suitable salted and hashed password scheme.
- Changes and complexity: Periodic password changes must not be required. However, a change must be required when compromise is detected.
- Usability: Guidance should be provided for selecting strong passwords, and users should be informed of the reason when a password is rejected7.
These guidelines balance security with user convenience.
In systems with moderate or higher risk, passwords alone are insufficient, and AAL2 includes requirements such as the following.
Authenticator control: High confidence is required that the claimant controls 1 or more authenticators bound to the subscriber account. Proof of possession and control of 2 distinct authentication factors is required through a secure authentication protocol.
Cryptography: Approved cryptographic techniques must be used. Authenticators used at AAL2 must be approved cryptographic authenticators.
Replay resistance: Authenticators used at AAL2 must include at least 1 authenticator resistant to replay attacks.
Authenticated channels: Communication between the claimant and verifier must occur over 1 or more authenticated protected channels.
Use of biometrics: When a biometric factor is used, it must meet specified performance requirements.
Phishing resistance: The verifier must provide at least 1 phishing-resistant authentication option. Federal agencies must require staff, contractors, and partners to use phishing-resistant authentication to access federal information systems.
The point worth noting as new is instead this “phishing resistance.” In practice, it would be correct to regard not only password-only authentication but also password plus OTP as prohibited.