# Password

Key: `identity.person.password`

Authentication credential. Broad categorization due to high variance in format and strength requirements. Should never be stored in plaintext. Hash or encrypt passwords immediately.

Page: <https://meridian.online/docs/projects/finetype/types/identity/person/password>

Samples: `aB3#xY9@mK2`, `MySecureP@ss123`, `correct-horse-battery-staple`

## Background

### Origin

The Compatible Time-Sharing System (CTSS), introduced at MIT in 1961, was the first computer system to implement password login.[[1]](https://en.wikipedia.org/wiki/Password) CTSS had a LOGIN command that requested a user password.[[1]](https://en.wikipedia.org/wiki/Password)

Robert Morris developed a way of storing login passwords in hashed form as part of the Unix operating system.[[1]](https://en.wikipedia.org/wiki/Password) That system first appeared in 6th Edition Unix in 1974.[[1]](https://en.wikipedia.org/wiki/Password) A later version of his algorithm, known as crypt(3), used a 12-bit salt.[[1]](https://en.wikipedia.org/wiki/Password)

Today the US National Institute of Standards and Technology sets out password rules in NIST Special Publication 800-63B.[[2]](https://pages.nist.gov/800-63-4/sp800-63b.html) It requires passwords used as a single-factor authentication mechanism to be a minimum of 15 characters in length.[[2]](https://pages.nist.gov/800-63-4/sp800-63b.html) Passwords used only as part of multi-factor authentication may be shorter, but must be a minimum of eight characters.[[2]](https://pages.nist.gov/800-63-4/sp800-63b.html) It says verifiers should permit a maximum password length of at least 64 characters.[[2]](https://pages.nist.gov/800-63-4/sp800-63b.html) It says verifiers should accept all printing ASCII characters and the space character in passwords.[[2]](https://pages.nist.gov/800-63-4/sp800-63b.html) It also says verifiers should accept Unicode characters in passwords.[[2]](https://pages.nist.gov/800-63-4/sp800-63b.html) It forbids other composition rules, such as requiring mixtures of different character types.[[2]](https://pages.nist.gov/800-63-4/sp800-63b.html) It forbids requiring subscribers to change passwords periodically, unless there is evidence the authenticator has been compromised.[[2]](https://pages.nist.gov/800-63-4/sp800-63b.html) New passwords must be compared against a blocklist of known commonly used, expected, or compromised passwords.[[2]](https://pages.nist.gov/800-63-4/sp800-63b.html)

The passphrase correct horse battery staple comes from xkcd comic 936, Password Strength.[[3]](https://xkcd.com/936/) That comic sets it against the harder-to-remember password Tr0ub4dor\&3.[[3]](https://xkcd.com/936/)

### Use

A column of plaintext passwords in a data file is a security incident, not an analysis input. (Meridian's view) If you find one, stop copying the file around, tell whoever owns the source system, and treat the values as compromised. (Meridian's view)

OWASP recommends Argon2id with a minimum of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.[[4]](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) Where Argon2id is not available, OWASP recommends scrypt.[[4]](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) For legacy systems using bcrypt, OWASP recommends a work factor of 10 or more.[[4]](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) If FIPS-140 compliance is required, OWASP recommends PBKDF2 with a work factor of 600,000 or more.[[4]](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)

Because modern guidance allows long passphrases, spaces and Unicode, there is no reliable pattern that marks a value as a password. (Meridian's view) A column's name and context say far more than its values: a short random string could just as easily be an API key, a voucher code or a session token. (Meridian's view) Never try to validate password values against a composition rule; the useful checks are whether the column should exist at all and whether it holds hashes rather than plaintext. (Meridian's view)

## Sources

1. [Password - Wikipedia](https://en.wikipedia.org/wiki/Password) — secondary source
2. [NIST Special Publication 800-63B](https://pages.nist.gov/800-63-4/sp800-63b.html) — standard
3. [xkcd: Password Strength](https://xkcd.com/936/) — secondary source
4. [Password Storage - OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) — secondary source