What the New NIST Guidelines Mean for Authentication

TL;DR: The US National Institute of Standards and Technology (NIST) is creating new policies for Federal agencies implementing authentication. Learn about NIST Special Publication 800-63-3: Digital Authentication Guideline and what it means for authentication security.

NIST Digital Authentication Guideline

The US National Institute of Standards and Technology (NIST) has created new policies for Federal agencies implementing authentication.

The Digital Identity Guidelines — Special Publication 800-63-3 — are available on the NIST website as well as on NIST's GitHub. The suite of documents includes the following:

• 800-63-3: Digital Authentication Guideline (overview)
• 800-63A: Enrollment & Identity Proofing
• 800-63B: Authentication & Lifecycle Management
• 800-63C: Federation & Assertions

The policies are intended for Federal agency applications, but serve as a standard for many others as well.

NIST Improved Password Requirements

The NIST Digital Authentication Guidelines strives for improved password requirements. One of the guiding principles is better user experience and shifting the burden to the verifier whenever possible. In order to support the creation of passwords that users will remember while implementing excellent security, several guidelines are important:

• Length: 8 character minimum, >64 character maximum
• Compare new passwords to a dictionary and don't allow common, easily-guessed passwords (such as

  password

  ,

  abc123

  , etc.)
• Allow all printing characters + spaces
• Should offer option to show password rather than dots or asterisks; helps typing accuracy
• Don't enforce composition rules (ie., no "passwords must include uppercase and lowercase letters, a number...", etc.); such rules provide a poor user experience
• Don't use password hints; they weaken authentication
• Don't expire passwords arbitrarily; regular expiration encourages users to choose easy-to-guess, less secure passwords
• Don't use Knowledge-based Authentication (KBA)

NIST Guidelines for Password Storage

NIST also supplies guidelines for the verifier's encryption and storage of passwords. These policies ensure that passwords are stored securely:

• Passwords shall be hashed with 32-bit (or greater) random salt
• Use approved key derivation function PBKDF2 using SHA-1, SHA-2, or SHA-3 with at least 10,000 iterations
• Passwords should use keyed HMAC hash with the key stored separately

NIST on Multifactor Authentication

NIST recommends utilizing out-of-band (OOB) authentication to provide 2-factor Authentication (2FA). The guidelines also state that SMS is deprecated for OOB authentication. SMS can be compromised by a variety of threats such as smartphone malware, SS7 attacks, forwarding, change of phone number, and more.

Examples of non-SMS OOB authenticators include Auth0 Guardian, Duo Mobile, and Google Authenticator. NIST states that use of biometrics must be with another authentication factor for Multifactor Authentication.

Conclusion

Overall, the new guidelines put the user experience at the forefront while also establishing more robust storage and authentication methods. Although the NIST Digital Authentication Guideline governs Federal sites, its tenets are good standards for any app or site with authentication. Federal agencies as well as many other companies and vendors must make strides to comply with the new guidelines for improved authentication security and user experience. Auth0 supports the NIST guidelines with more configurable password policies. To learn more, check out the NIST Special Publication 800-63-3 itself and Jim Fenton's "Toward Better Password Requirements" presentation.