NIST Password Standards

Screen Passwords in Compliance with the NIST 800-63B Password Recommendations

NIST 800-63B Digital Identity Guidelines for Authentication recommends checking new passwords against passwords used in cybercriminal dictionary attacks:

"When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised."

Why is NIST recommending this new approach?

The National Institute of Standards and Technology (NIST) password recommendations include this type of screening because it matches the methods used by cybercriminals in modern brute force attacks.

It’s become clear that people follow very common patterns in password selection, even with a written password policy in place. As a result, cybercriminals use lists of common passwords and patterns found in previous breaches to narrow the universe of passwords attempted in their attacks. Guessing passwords becomes easier when the actual set of passwords is predictable.

NIST 800-63B section 5.1.1 explains the objective:

"Memorized secrets (i.e. passwords) need to be of sufficient complexity and secrecy that it would be impractical for an attacker to guess or otherwise discover the correct secret value."

The NIST recommendation is to screen for commonly used and compromised passwords to prevent people from selecting these easy to guess passwords.

To satisfy compliance, Enzoic continuously collects compromised passwords and aggregates cracking dictionaries to create a comprehensive blacklist of unsafe passwords. Our list contains billions of entries. It includes every word from every Wikipedia article in all languages and every clear text password from over 3,000 data breaches.

While this blacklist continues to evolve, the rate at which new unique entries are being added has dramatically slowed giving us confidence that we’ve captured a nearly complete universe of the common passwords used by hackers.

Ready to Start Screening Passwords?

Enzoic provides an easy way to satisfy this requirement. Our researchers maintain a list of unsafe passwords, combining numerous cracking dictionaries and previously breached passwords circulated on the Internet and Dark Web. Our Microsoft Active Directory plugin and RESTful API makes it easy to screen for unsafe passwords.

Prevent compromised passwords. Comply with NIST 800-63B

Get a Demo