v5.0.0-6.2.1 password min length vs NIST SP 800-63B-4

[elarlang]

Current requirement:

#	Description	Level
6.2.1	Verify that user set passwords are at least 8 characters in length although a minimum of 15 characters is strongly recommended.	1

Previously discussed in:

• 2.1.1 Reconsider minimal length of passwords #913
• password security #1540

We made current requirement based on this version:

Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.

Now NIST SP 800-63-4 is released and it defines it:

Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length. Verifiers and CSPs MAY allow passwords that are only used as part of multi-factor authentication processes to be shorter but SHALL require them to be a minimum of eight characters in length.

So, to be aligned with NIST, we need to require:

• min length 15 if multi-factor authentication is not used
• min length 8 if multi-factor authentication is used

But there is no quick-and-easy fix here, as it could be a breaking change for v5.0.0.

[jmanico]

Do you think we should split this into 2 requirements, or do something like:

6.2.1 | Verify that user set passwords are at least 15 characters in length. For L2 apps, a minimum of 8 characters is acceptable due to required multi-factor use. | 1

[elarlang]

Do you think we should split this into 2 requirements, or do something like:

No spliting, we should have only one requirement that defines the min length for passwords.

I think we don't need to take levels into the requirement text here, because it is related only with single- or multi-factor in use in the application.

Verify that user-set passwords are at least 15 characters in length if only a single-factor authentication mechanism is used, and at least 8 characters in length if a multi-factor authentication mechanism is used.

[ottosulin]

I agree with keeping it as one requirement without levels.

Minimum possible change if we want to include this but don't want breaking changes would be something like:
"Verify that user set passwords are at least 8 characters in length if multi-factor authentication is used, otherwise a minimum of 15 characters is strongly recommended."

[jmanico]

I think these are both great suggestions to minimally change this one. 🤙🏽