Why would Bill Burr of NIST say N3v$r M1^d?

Question

Wall Street Journal wrote that Bill regrets his password recommendations NIST SP 800-63 Appendix A.

Apprendix A is titled "Estimating Password Entropy and Strength". It is about how we might assess password strength - not about rules to control password creation.

Bill discusses hyperthetical password rules and posits how a user might comply with these rules and how their behavour is likely to affect password strength or entrophy calculation.

For example, elimination of dictionary words (for short passwords) and requiring uppercase, lowercase, digits, and symbols means an attacker needs to check fewer combinations.

Same for checking against a database of common passwords.

Bill believes that dictionary and composition rules generally improve “practical entropy” of passwords.

But Bill warns that enforcing uppercase, digits, and symbols is likely to result in a change at begining or end of a password and hence discounts entrophy value of using these characters within a password.

Discussion concerning frequency of changing passwords is limited to assessing likelihood of an attacker being successful in an in-band attack.

Articles like this one from theverge based on WSJ article, claims that Bill recommended passwords be changed every 90 days - It does not suggest this.

Am I reading wrong document or reading document wrong?

Did NIST ever recommend uppercase, digits, symbols and 90-day or regular enforced changing of passwords?

Answer 1

Data

The Wall Street Journal article says:

The problem is the advice ended up largely incorrect, Mr. Burr says. Change your password every 90 days? Most people make minor changes that are easy to guess, he laments.

In that context the "90 days" appears to be his current summary of what was put in place as the result of his recommendations 15 years ago. I do not read that as quoting NIST 800-63 v1.0 as saying "90 days" anywhere. And when we look at the Verge article, which appears to be based on the WSJ article, they've changed that to:

Even worse, Burr suggested people should change passwords regularly, at least every 90 days.

I don't get that from the original quote, and I think that it's a mis-representation of the original quote.

So let's look at the "original", or at least, the oldest version I can find: NIST SP 800-63 Version 1, September 2004. (A list of many versions is available from NIST.)

Appendix A does not contain any reference to 90 days. It does contain a reference to 90 years:

Such a lock out would suffice to limit automated attacks to 3 trials a minute and it would take about 90 years to carryout 2^25.5 trials. If the system required that password authentication attempts be locked for one minute after three unsuccessful trials and that passwords be changed every ten years, then the targeted password guessing attack requirements of level 2 would be comfortably satisfied.

And he demonstrates how the entropy of a password and the lockout conditions can be used to calculate how susceptible a password is to online brute forcing:

For example, consider a system that required passwords to be changed every two years and limited trials by locking an account for 24 hours after 6 successive failed authentication attempts. An attacker could get 2 ´ 365 ´ 6 = 4,380 attempts during the life of the password and this would easily meet the targeted attack requirements of level 2.

If you search for keywords like 'change', 'rotate', 'hour', 'day', 'month' you will not find any specific advice which says passwords should be changed every 90 days.

That's the data we have. Now:

---

Opinion

Appendix A of SP 800-63 v1 explained the idea of entropy as a measurable aspect of passwords, described ways that more entropy could be employed in password strings of given lengths, and drew a connection between acceptable password timeframes based on average guessing with online constraints.

In practice, a lot of people looked at that and said "Okay, so we'll set password complexity requirements, and require rotation, and we'll be A-Okay!"

In hindsight, this was regrettable, for the following reasons:

• It discussed online brute force attacks, where delays can greatly slow down an attacks. The combination of Moore's law and offline brute force attacks shredded those assumptions like a tiger with a box of goat-flavored Kleenex.
• It had the overall effect of emphasizing short, complex passwords, just because it focused on exploring their mathematics. But the fact of the matter is, the Appendix itself knew this wasn't preferred! It said "...many people may prefer to memorize a relatively long “pass-phrases” of words, rather than a shorter, more arbitrary password." Fast forward today, and where are we? "Passphrases are better than passwords." It's not Burr's fault people ignored that.

In summary, NIST SP 800-63 v1 may have been as damaging as Burr thinks it was - but it wasn't his fault. People drew short-sighted conclusions based on a report that stated up front how little data it had to work with in making recommendations. It was better than nothing at the time and it has been our failure - choosing to rely on it, rather than trying to resolve the lack of empirical data that the report called out.

On that note, I'll leave you with this part of the Appendix intro:

Unfortunately, we do not have much data on the passwords users choose under particular rules, and much of what we do know is found empirically by “cracking” passwords, that is by system administrators applying massive dictionary attacks to the files of hashed passwords (in most systems no plaintext copy of the password is kept) on their systems. NIST would like to obtain more data on the passwords users actually choose, but, where they have the data, system administrators are understandably reluctant to reveal password data to others. Empirical and anecdotal data suggest that many users choose very easily guessed passwords, where the system will allow them to do so.