Password policy

Last updated October 23, 2024

A password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly. A password policy is often part of an organization's official regulations and may be taught as part of security awareness training. Either the password policy is merely advisory, or the computer systems force users to comply with it. Some governments have national authentication frameworks^[1] that define requirements for user authentication to government services, including requirements for passwords.

NIST guidelines

The United States Department of Commerce's National Institute of Standards and Technology (NIST) has put out two standards for password policies which have been widely followed.

2004

From 2004, the "NIST Special Publication 800-63. Appendix A,"^[2] advised people to use irregular capitalization, special characters, and at least one numeral. This was the advice that most systems followed, and was "baked into" a number of standards that businesses needed to follow.

2017

However, in 2017 a major update changed this advice, particularly that forcing complexity and regular changes is now seen as bad practice.^[3]^[4]^: 5.1.1.2

The key points of these are:

Verifiers shall not impose composition rules (e.g., not require mixtures of different character types and not prohibit consecutively repeated characters) (note that this was changed in revision 4 from should not to shall not)^[5]
Verifiers shall not require passwords to be changed arbitrarily or regularly (e.g. no 90-day or 365-day change rule)
Passwords must be at least 8 characters in length
Password systems should permit subscriber-chosen passwords at least 64 characters in length.
All printing ASCII characters, the space character, and Unicode characters should be acceptable in passwords
When establishing or changing passwords, the verifier shall advise the subscriber that they need to select a different password if they have chosen a weak or compromised password
Verifiers should offer guidance such as a password-strength meter, to assist the user in choosing a strong password
Verifiers shall store passwords in a form that is resistant to offline attacks. Passwords shall be salted and hashed using a suitable one-way key derivation function. Key derivation functions take a password, a salt, and a cost factor as inputs then generate a password hash. Their purpose is to make each password guessing trial by an attacker who has obtained a password hash file expensive and therefore the cost of a guessing attack high or prohibitive.

NIST included a rationale for the new guidelines in its Appendix A.

Aspects

Typical components of a password policy include:

Password length and formation

Many policies require a minimum password length. Eight characters is typical but may not be appropriate.^[6]^[7]^[8] Longer passwords are almost always more secure, but some systems impose a maximum length for compatibility with legacy systems.

Some policies suggest or impose requirements on what type of password a user can choose, such as:

the use of both upper-case and lower-case letters (case sensitivity)
inclusion of one or more numerical digits
inclusion of special characters, such as @, #, $
prohibition of words found in a password blocklist
prohibition of words found in the user's personal information
prohibition of use of company name or an abbreviation
prohibition of passwords that match the format of calendar dates, license plate numbers, telephone numbers, or other common numbers

Other systems create an initial password for the user; but require then to change it to one of their own choosing within a short interval.

Password block list

Password block lists are lists of passwords that are always blocked from use. Block lists contain passwords constructed of character combinations that otherwise meet company policy, but should no longer be used because they have been deemed insecure for one or more reasons, such as being easily guessed, following a common pattern, or public disclosure from previous data breaches. Common examples are Password1, Qwerty123, or Qaz123wsx.

Password duration

Some policies require users to change passwords periodically, often every 90 or 180 days. The benefit of password expiration, however, is debatable.^[9]^[10] Systems that implement such policies sometimes prevent users from picking a password too close to a previous selection.^[11]

This policy can often backfire. Some users find it hard to devise "good" passwords that are also easy to remember, so if people are required to choose many passwords because they have to change them often, they end up using much weaker passwords; the policy also encourages users to write passwords down. Also, if the policy prevents a user from repeating a recent password, this requires that there is a database in existence of everyone's recent passwords (or their hashes) instead of having the old ones erased from memory. Finally, users may change their password repeatedly within a few minutes, and then change back to the one they really want to use, circumventing the password change policy altogether.

The human aspects of passwords must also be considered. Unlike computers, human users cannot delete one memory and replace it with another. Consequently, frequently changing a memorized password is a strain on the human memory, and most users resort to choosing a password that is relatively easy to guess (See Password fatigue). Users are often advised to use mnemonic devices to remember complex passwords. However, if the password must be repeatedly changed, mnemonics are useless because the user would not remember which mnemonic to use. Furthermore, the use of mnemonics (leading to passwords such as "2BOrNot2B") makes the password easier to guess.

Administration factors can also be an issue. Users sometimes have older devices that require a password that was used before the password duration expired.^{[ clarification needed ]} In order to manage these older devices, users may have to resort to writing down all old passwords in case they need to log into an older device.

Requiring a very strong password and not requiring it be changed is often better.^[12] However, this approach does have a major drawback: if an unauthorized person acquires a password and uses it without being detected, that person may have access for an indefinite period.

It is necessary to weigh these factors: the likelihood of someone guessing a password because it is weak, versus the likelihood of someone managing to steal, or otherwise acquire without guessing, a stronger password.

Bruce Schneier argues that "pretty much anything that can be remembered can be cracked", and recommends a scheme that uses passwords which will not appear in any dictionaries.^[13]

Sanction

Password policies may include progressive sanctions beginning with warnings and ending with possible loss of computer privileges or job termination. Where confidentiality is mandated by law, e.g. with classified information, a violation of password policy could be a criminal offense in some jurisdictions.^[14] Some^{[ who? ]} consider a convincing explanation of the importance of security to be more effective than threats of sanctions^{[ citation needed ]}.

Selection process

The level of password strength required depends, among other things, on how easy it is for an attacker to submit multiple guesses. Some systems limit the number of times a user can enter an incorrect password before some delay is imposed or the account is frozen. At the other extreme, some systems make available a specially hashed version of the password, so that anyone can check its validity. When this is done, an attacker can try passwords very rapidly; so much stronger passwords are necessary for reasonable security. (See password cracking and password length equation.) Stricter requirements are also appropriate for accounts with higher privileges, such as root or system administrator accounts.

Usability considerations

Password policies are usually a tradeoff between theoretical security and the practicalities of human behavior. For example:

Requiring excessively complex passwords and forcing them to be changed frequently can cause users to write passwords down in places that are easy for an intruder to find, such as a Rolodex or post-it note near the computer.
Users often have dozens of passwords to manage. It may be more realistic to recommend a single password be used for all low security applications, such as reading on-line newspapers and accessing entertainment web sites.
Similarly, demanding that users never write down their passwords may be unrealistic and lead users to choose weak ones (or cause a lot of inconvenience when users forget their password). An alternative is to suggest keeping written passwords in a secure place, such as a safe or an encrypted master file. The validity of this approach depends on what the most likely threat is deemed to be. While writing down a password may be problematic if potential attackers have access to the secure store, if the threat is primarily remote attackers who do not have access to the store, it can be a very secure method.
Inclusion of special characters can be a problem if a user has to log onto a computer in a different country. Some special characters may be difficult or impossible to find on keyboards designed for another language.
Some identity management systems allow self-service password reset, where users can bypass password security by supplying an answer to one or more security questions such as "where were you born?", "what's your favorite movie?", etc. Often the answers to these questions can easily be obtained by social engineering, phishing or simple research.

A 2010 examination of the password policies of 75 different websites concludes that security only partly explains more stringent policies: monopoly providers of a service, such as government sites, have more stringent policies than sites where consumers have choice (e.g. retail sites and banks). The study concludes that sites with more stringent policies "do not have greater security concerns, they are simply better insulated from the consequences from poor usability."^[15]

Other approaches are available that are generally considered to be more secure than simple passwords. These include use of a security token or one-time password system, such as S/Key, or multi-factor authentication.^[16] However, these systems heighten the tradeoff between security and convenience: according to Shuman Ghosemajumder, these systems all improve security, but come "at the cost of moving the burden to the end user."^[17]

Related Research Articles

A password, sometimes called a passcode, is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of password-protected services that a typical individual accesses can make memorization of unique passwords for each service impractical. Using the terminology of the NIST Digital Identity Guidelines, the secret is held by a party called the claimant while the party verifying the identity of the claimant is called the verifier. When the claimant successfully demonstrates knowledge of the password to the verifier through an established authentication protocol, the verifier is able to infer the claimant's identity.

An authenticator is a means used to confirm a user's identity, that is, to perform digital authentication. A person authenticates to a computer system or application by demonstrating that he or she has possession and control of an authenticator. In the simplest case, the authenticator is a common password.

A passphrase is a sequence of words or other text used to control access to a computer system, program or data. It is similar to a password in usage, but a passphrase is generally longer for added security. Passphrases are often used to control both access to, and the operation of, cryptographic programs and systems, especially those that derive an encryption key from a passphrase. The origin of the term is by analogy with password. The modern concept of passphrases is believed to have been invented by Sigmund N. Porter in 1982.

In computer security, challenge-response authentication is a family of protocols in which one party presents a question ("challenge") and another party must provide a valid answer ("response") to be authenticated.

A cryptographic hash function (CHF) is a hash algorithm that has special properties desirable for a cryptographic application:

In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys from a secret value such as a master key, a password, or a passphrase using a pseudorandom function. KDFs can be used to stretch keys into longer keys or to obtain keys of a required format, such as converting a group element that is the result of a Diffie–Hellman key exchange into a symmetric key for use with AES. Keyed cryptographic hash functions are popular examples of pseudorandom functions used for key derivation.

In cryptanalysis and computer security, password cracking is the process of guessing passwords protecting a computer system. A common approach is to repeatedly try guesses for the password and to check them against an available cryptographic hash of the password. Another type of approach is password spraying, which is often automated and occurs slowly over time in order to remain undetected, using a list of common passwords.

In cryptography, a salt is random data fed as an additional input to a one-way function that hashes data, a password or passphrase. Salting helps defend against attacks that use precomputed tables, by vastly growing the size of table needed for a successful attack. It also helps protect passwords that occur multiple times in a database, as a new salt is used for each password instance. Additionally, salting does not place any burden on users.

A one-time password (OTP), also known as a one-time PIN, one-time passcode, one-time authorization code (OTAC) or dynamic password, is a password that is valid for only one login session or transaction, on a computer system or other digital device. OTPs avoid several shortcomings that are associated with traditional (static) password-based authentication; a number of implementations also incorporate two-factor authentication by ensuring that the one-time password requires access to something a person has as well as something a person knows.

A security token is a peripheral device used to gain access to an electronically restricted resource. The token is used in addition to, or in place of, a password. Examples of security tokens include wireless key cards used to open locked doors, a banking token used as a digital authenticator for signing in to online banking, or signing transactions such as wire transfers.

A random password generator is a software program or hardware device that takes input from a random or pseudo-random number generator and automatically generates a password. Random passwords can be generated manually, using simple sources of randomness such as dice or coins, or they can be generated using a computer.

A rainbow table is a precomputed table for caching the outputs of a cryptographic hash function, usually for cracking password hashes. Passwords are typically stored not in plain text form, but as hash values. If such a database of hashed passwords falls into the hands of attackers, they can use a precomputed rainbow table to recover the plaintext passwords. A common defense against this attack is to compute the hashes using a key derivation function that adds a "salt" to each password before hashing it, with different passwords receiving different salts, which are stored in plain text along with the hash.

Living in the intersection of cryptography and psychology, password psychology is the study of what makes passwords or cryptographic keys easy to remember or guess.

In cryptography, key stretching techniques are used to make a possibly weak key, typically a password or passphrase, more secure against a brute-force attack by increasing the resources it takes to test each possible key. Passwords or passphrases created by humans are often short or predictable enough to allow password cracking, and key stretching is intended to make such attacks more difficult by complicating a basic step of trying a single password candidate. Key stretching also improves security in some real-world applications where the key length has been constrained, by mimicking a longer key length from the perspective of a brute-force attacker.

Password strength is a measure of the effectiveness of a password against guessing or brute-force attacks. In its usual form, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to guess it correctly. The strength of a password is a function of length, complexity, and unpredictability.

<span class="mw-page-title-main">Cryptographic nonce</span> Concept in cryptography

In cryptography, a nonce is an arbitrary number that can be used just once in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that each communication session is unique, and therefore that old communications cannot be reused in replay attacks. Nonces can also be useful as initialization vectors and in cryptographic hash functions.

Electronic authentication is the process of establishing confidence in user identities electronically presented to an information system. Digital authentication, or e-authentication, may be used synonymously when referring to the authentication process that confirms or certifies a person's identity and works. When used in conjunction with an electronic signature, it can provide evidence of whether data received has been tampered with after being signed by its original sender. Electronic authentication can reduce the risk of fraud and identity theft by verifying that a person is who they say they are when performing transactions online.

KDE Wallet Manager (KWallet) is free and open-source password management software written in C++ for UNIX-style operating systems. KDE Wallet Manager runs on a Linux-based OS and Its main feature is storing encrypted passwords in KDE Wallets. The main feature of KDE wallet manager (KWallet) is to collect user's credentials such as passwords or IDs and encrypt them through Blowfish symmetric block cipher algorithm or GNU Privacy Guard encryption.

Multi-factor authentication is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence to an authentication mechanism. MFA protects personal data—which may include personal identification or financial assets—from being accessed by an unauthorized third party that may have been able to discover, for example, a single password.

In cryptography, a pepper is a secret added to an input such as a password during hashing with a cryptographic hash function. This value differs from a salt in that it is not stored alongside a password hash, but rather the pepper is kept separate in some other medium, such as a Hardware Security Module. Note that the National Institute of Standards and Technology refers to this value as a secret key rather than a pepper. A pepper is similar in concept to a salt or an encryption key. It is like a salt in that it is a randomized value that is added to a password hash, and it is similar to an encryption key in that it should be kept secret.

References

↑ Improving Usability of Password Management with Standardized Password Policies. Retrieved on 2012-10-12.
↑ "Electronic Authentication Guideline" (PDF). nist.gov. USG. Retrieved 9 April 2020.
↑ Statt, Nick (7 August 2017). "Best practices for passwords updated after original author regrets his advice". The Verge. Retrieved 9 April 2020.
↑ Grassi Paul A. (June 2017). SP 800-63B-3 – Digital Identity Guidelines, Authentication and Lifecycle Management. NIST. doi:10.6028/NIST.SP.800-63b. This article incorporates text from this source, which is in the public domain .
↑ "SP 800-63B-4 – Digital Identity Guidelines, Authentication and Lifecycle Management". NIST. Dec 2023.
↑ "Password Complexity Requirements". The Bug Charmer. September 7, 2012.
↑ "How long should passwords be?". The Bug Charmer. June 20, 2016.
↑ John D. Sutter (August 20, 2010). "How to create a 'super password'". CNN. Retrieved August 31, 2016.
↑ "The problems with forcing regular password expiry". IA Matters. CESG: the Information Security Arm of GCHQ. 15 April 2016. Archived from the original on 17 August 2016. Retrieved 5 Aug 2016.
↑ spaf (April 19, 2006). "Security Myths and Passwords". CERIAS.
↑ "Tip: Best Practices for Enforcing Password Policies". Microsoft . Retrieved 2018-03-01.
↑ Yinqian Zhang; Fabian Monrose; Michael K. Reiter (2010). The Security of Modern Password Expiration: An Algorithmic Framework and Empirical Analysis (PDF). Proceedings of the 17th ACM conference on Computer and communications security. New York, NY, US. pp. 176–186. doi:10.1145/1866307.1866328.
↑ "Choosing Secure Passwords". BoingBoing. March 2014 – via Schneier on Security.
↑ Williams, Jamie (July 11, 2016). "Ever Use Someone Else's Password? Go to Jail, says the Ninth Circuit". Electronic Frontier Foundation.
↑ Florêncio, Dinei; Herley, Cormac (2010-07-14). Where do security policies come from?. SOUPS '10: Proceedings of the Sixth Symposium on Usable Privacy and Security. pp. 1–14. doi:10.1145/1837110.1837124 – via ACM Digital Library.
↑ spaf (May 11, 2006). "Passwords and Myth". CERIAS.
↑ Rosenbush, Steven; Norton, Steven (May 27, 2015). "For CISOs, IRS Breach Highlights Tension Between Security and User Convenience". The Wall Street Journal.

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.

[1] Improving Usability of Password Management with Standardized Password Policies. Retrieved on 2012-10-12.

[2] "Electronic Authentication Guideline" (PDF). nist.gov. USG. Retrieved 9 April 2020.

[3] Statt, Nick (7 August 2017). "Best practices for passwords updated after original author regrets his advice". The Verge. Retrieved 9 April 2020.

[sp800-63B-4] Grassi Paul A. (June 2017). SP 800-63B-3 – Digital Identity Guidelines, Authentication and Lifecycle Management. NIST. doi:10.6028/NIST.SP.800-63b. This article incorporates text from this source, which is in the public domain .

[sp800-63B-4-5] "SP 800-63B-4 – Digital Identity Guidelines, Authentication and Lifecycle Management". NIST. Dec 2023.

[6] "Password Complexity Requirements". The Bug Charmer. September 7, 2012.

[7] "How long should passwords be?". The Bug Charmer. June 20, 2016.

[8] John D. Sutter (August 20, 2010). "How to create a 'super password'". CNN. Retrieved August 31, 2016.

[WEB-9] "The problems with forcing regular password expiry". IA Matters. CESG: the Information Security Arm of GCHQ. 15 April 2016. Archived from the original on 17 August 2016. Retrieved 5 Aug 2016.

[10] spaf (April 19, 2006). "Security Myths and Passwords". CERIAS.

[11] "Tip: Best Practices for Enforcing Password Policies". Microsoft . Retrieved 2018-03-01.

[12] Yinqian Zhang; Fabian Monrose; Michael K. Reiter (2010). The Security of Modern Password Expiration: An Algorithmic Framework and Empirical Analysis (PDF). Proceedings of the 17th ACM conference on Computer and communications security. New York, NY, US. pp. 176–186. doi:10.1145/1866307.1866328.

[13] "Choosing Secure Passwords". BoingBoing. March 2014 – via Schneier on Security.

[14] Williams, Jamie (July 11, 2016). "Ever Use Someone Else's Password? Go to Jail, says the Ninth Circuit". Electronic Frontier Foundation.

[15] Florêncio, Dinei; Herley, Cormac (2010-07-14). Where do security policies come from?. SOUPS '10: Proceedings of the Sixth Symposium on Usable Privacy and Security. pp. 1–14. doi:10.1145/1837110.1837124 – via ACM Digital Library.

[16] spaf (May 11, 2006). "Passwords and Myth". CERIAS.

[17] Rosenbush, Steven; Norton, Steven (May 27, 2015). "For CISOs, IRS Breach Highlights Tension Between Security and User Convenience". The Wall Street Journal.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]