New Password Rules Recommended by NIST
NIST has updated its Digital Identity Guidelines, which provide technical guidance for organizations to implement digital identity services and outlines requirements for credential service providers (CSPs) for remote user authentication at three different authentication assurance levels.
For example, the document includes updated guidelines regarding the complexity of passwords. These requirements state that verifiers and CSPs:
- SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.
- SHOULD permit a maximum password length of at least 64 characters.
- SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords.
- SHOULD accept Unicode [ISO/ISC 10646] characters in passwords.
- SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.
- SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise.
- SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant.
- SHALL NOT prompt subscribers to use knowledge-based authentication (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.
- SHALL verify the entire submitted password (i.e., not truncate it).
The document notes that “length and complexity requirements beyond those recommended here significantly increase the difficulty of using passwords and increase user frustration.”
Other approaches, such as “blocklists, secure hashed storage, machine-generated random passwords, and rate limiting are more effective at preventing modern brute-force attacks, so no additional complexity requirements are imposed,” it states.
The comprehensive guidelines address many other authentication factors and detail both “process and technical requirements for meeting digital identity management assurance levels.”
Learn more at NIST.
Related content
-
Lithnet Password Protection for Active Directory
Lithnet Password Protection for Active Directory provides flexible rules beyond that possible with group policies alone and prevents the use of previously compromised passwords. - New Report Exposes the Prevalence of Lame Passwords
-
Two-Factor Authentication
Making your systems really secure can be a bit more complicated than resorting to the use of regular passwords. In this article, we provide an overview of authentication solutions and present potential approaches for common use cases.
-
John the Ripper
Easy to remember but difficult to guess isn’t just a catchy phrase for choosing passwords, it’s the law of the Net. Learn how to check your password using a tool network intruders use every day: John the Ripper.
-
Secure remote access and web applications with two-factor authentication
Making your systems really secure can be a bit more complicated than resorting to the use of regular passwords. In this article, we provide an overview of authentication solutions and present potential approaches for common use cases.