`11` References

NIST PIV and digital identity SP 800-63B-4 against SP 800-63B
All changes in this version

removed 11 References

Title changed

Before · SP 800-63B

References

After · SP 800-63B-4

~~References~~

Control changed

Before · SP 800-63B

This section is informative.

General References

[BALLOON] Boneh, Dan, Corrigan-Gibbs, Henry, and Stuart Schechter. “Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks,” Asiacrypt 2016 , October 2016. Available at: https://eprint.iacr.org/2016/027 .

[Blacklists] Habib, Hana, Jessica Colnago, William Melicher, Blase Ur, Sean Segreti, Lujo Bauer, Nicolas Christin, and Lorrie Cranor. “Password Creation in the Presence of Blacklists,” 2017. Available at: https://www.ndss-symposium.org/wp- content/uploads/2017/09/usec2017_01_3_Habib_paper.pdf .

[Composition] Komanduri, Saranga, Richard Shay, Patrick Gage Kelley, Michelle L Mazurek, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Serge Egelman. “Of Passwords and People: Measuring the Effect of Password-Composition Policies.” In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, 2595–2604. ACM, 2011. Available at: https://www.ece.cmu.edu/~lbauer/papers/2011/chi2011-passwords.pdf .

[E-Gov] E-Government Act [includes FISMA] (P.L. 107-347), December 2002, available at: http://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf .

[EO 13681] Executive Order 13681, Improving the Security of Consumer Financial Transactions , October 17, 2014, available at: https://www.federalregister.gov/d/2014-25439 .

[FEDRAMP] General Services Administration, Federal Risk and Authorization Management Program , available at: https://www.fedramp.gov/ .

[ICAM] National Security Systems and Identity, Credential and Access Management Sub- Committee Focus Group, Federal CIO Council, ICAM Lexicon , Version 0.5, March 2011.

[M-03-22] OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 , September 26, 2003, available at: https://georgewbush-whitehouse.archives.gov/omb/memoranda/m03-22.html .

[M-04-04] OMB Memorandum M-04-04, E-Authentication Guidance for Federal Agencies , December 16, 2003, available at: https://georgewbush- whitehouse.archives.gov/omb/memoranda/fy04/m04-04.pdf .

[Meters] de Carné de Carnavalet, Xavier and Mohammad Mannan. “From Very Weak to Very Strong: Analyzing Password-Strength Meters.” In Proceedings of the Network and Distributed System Security Symposium (NDSS), 2014. Available at: http://www.internetsociety.org/sites/default/files/06_3_1.pdf . [NISTIR8062] NIST Internal Report 8062, An Introduction to Privacy Engineering and Risk Management in Federal Systems , January 2017, available at: http://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8062.pdf .

[NIST Usability] National Institute and Standards and Technology, Usability & Biometrics, Ensuring Successful Biometric Systems , June 11, 2008, available at: http://www.nist.gov/customcf/get_pdf.cfm?pub_id=152184 .

[OWASP-session] Open Web Application Security Project, Session Management Cheat Sheet , available at: https://www.owasp.org/index.php/Session_Management_Cheat_Sheet .

[OWASP-XSS-prevention] Open Web Application Security Project, XSS (Cross Site Scripting) Prevention Cheat Sheet , available at: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet .

[Persistence] Herley, Cormac, and Paul van Oorschot. “A Research Agenda Acknowledging the Persistence of Passwords,” IEEE Security&Privacy Magazine, 2012. Available at: http://research.microsoft.com/apps/pubs/default.aspx?id=154077 .

[Privacy Act] Privacy Act of 1974 (P.L. 93-579), December 1974, available at: https://www.justice.gov/opcl/privacy-act-1974 .

[Policies] Weir, Matt, Sudhir Aggarwal, Michael Collins, and Henry Stern. “Testing Metrics for Password Creation Policies by Attacking Large Sets of Revealed Passwords.” In Proceedings of the 17th ACM Conference on Computer and Communications Security, 162–175. CCS ’10. New York, NY, USA: ACM, 2010. doi:10.1145/1866307.1866327.

[Section 508] Section 508 Law and Related Laws and Policies (January 30, 2017), available at: https://www.section508.gov/content/learn/laws-and-policies .

[Shannon] Shannon, Claude E. “A Mathematical Theory of Communication,” Bell System Technical Journal , v. 27, pp. 379-423, 623-656, July, October, 1948.

[Strength] Kelley, Patrick Gage, Saranga Komanduri, Michelle L Mazurek, Richard Shay, Timothy Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, and Julio Lopez. “Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms.” In Security and Privacy (SP), 2012 IEEE Symposium On, 523–537. IEEE, 2012. Available at: http://ieeexplore.ieee.org/iel5/6233637/6234400/06234434.pdf .

Standards

[BCP 195] Sheffer, Y., Holz, R., and P. Saint-Andre, Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) , BCP 195, RFC 7525, DOI 10.17487/RFC7525, May 2015, https://doi.org/10.17487/RFC7525 .

[ISO 9241-11] International Standards Organization, ISO/IEC 9241-11 Ergonomic requirements for office work with visual display terminals (VDTs) — Part 11: Guidance on usability , March 1998, available at: https://www.iso.org/standard/16883.html . [ISO/IEC 2382-37] International Standards Organization, Information technology — Vocabulary — Part 37: Biometrics , 2017, available at: http://standards.iso.org/ittf/PubliclyAvailableStandards/c066693_ISO_IEC_2382- 37_2017.zip .

[ISO/IEC 10646] International Standards Organization, Universal Coded Character Set , 2014, available at: http://standards.iso.org/ittf/PubliclyAvailableStandards/c063182_ISO_IEC_10646_2014.zip .

[ISO/IEC 24745] International Standards Organization, Information technology — Security techniques — Biometric information protection , 2011, available at: http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=52946 .

[ISO/IEC 30107-1] International Standards Organization, Information technology — Biometric presentation attack detection — Part 1: Framework , 2016, available at: http://standards.iso.org/ittf/PubliclyAvailableStandards/c053227_ISO_IEC_30107- 1_2016.zip .

[ISO/IEC 30107-3] International Standards Organization, Information technology — Biometric presentation attack detection — Part 3: Testing and reporting , 2017.

[RFC 20] Cerf, V., ASCII format for network interchange , STD 80, RFC 20, DOI 10.17487/RFC0020, October 1969, https://doi.org/10.17487/RFC0020 .

[RFC 5246] IETF, The Transport Layer Security (TLS) Protocol Version 1.2 , RFC 5246, DOI 10.17487/RFC5246, August 2008, https://doi.org/10.17487/RFC5246 .

[RFC 5280] IETF, Internet X.509 Public Key Infrastructure Certificate and CRL Profile , RFC 5280, DOI 10.17487/RFC5280, May 2008, https://doi.org/10.17487/RFC5280 .

[RFC 6238] IETF, TOTP: Time-Based One-Time Password Algorithm , RFC 6238, DOI 10.17487/RFC6238, https://doi.org/10.17487/RFC6238 .

[RFC 6960] IETF, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP , RFC 6960, DOI 10.17487/RFC6960, https://doi.org/10.17487/RFC6960 .

[UAX 15] Unicode Consortium, Unicode Normalization Forms , Unicode Standard Annex 15, Version 9.0.0, February 2016, available at: http://www.unicode.org/reports/tr15/ .

NIST Special Publications

NIST 800 Series Special Publications are available at: http://csrc.nist.gov/publications/PubsSPs.html . The following publications may be of particular interest to those implementing systems of applications requiring digital authentication.

[SP 800-38B] NIST Special Publication 800-38B, Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication , October 2016, https://doi.org/10.6028/NIST.SP.800-38B . [SP 800-52] NIST Special Publication 800-52 Revision 1, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations , April 2014, https://doi.org/10.6028/NIST.SP.800-52r1 .

[SP 800-53] NIST Special Publication 800-53 Revision 4, Recommended Security and Privacy Controls for Federal Information Systems and Organizations , April 2013 (updated January 22, 2015), https://doi.org/10.6028/NIST.SP.800-53r4 .

[SP 800-57 Part 1] NIST Special Publication 800-57 Part 1, Revision 4, Recommendation for Key Management, Part 1: General , January 2016, https://doi.org/10.6028/NIST.SP.800-57pt1r4 .

[SP 800-63-3] NIST Special Publication 800-63-3, Digital Identity Guidelines , June 2017, https://doi.org/10.6028/NIST.SP.800-63-3 .

[SP 800-63A] NIST Special Publication 800-63A, Digital Identity Guidelines: Enrollment and Identity Proofing Requirements , June 2017, https://doi.org/10.6028/NIST.SP.800-63a .

[SP 800-63C] NIST Special Publication 800-63C, Digital Identity Guidelines: Federation and Assertions , June 2017, https://doi.org/10.6028/NIST.SP.800-63c .

[SP 800-90Ar1] NIST Special Publication 800-90A Revision 1, Recommendation for Random Number Generation Using Deterministic Random Bit Generators , June 2015, https://doi.org/10.6028/NIST.SP.800-90Ar1 .

[SP 800-107] NIST Special Publication 800-107 Revision 1, Recommendation for Applications Using Approved Hash Algorithms , August 2012, https://doi.org/10.6028/NIST.SP.800-107r1 .

[SP 800-131A] NIST Special Publication 800-131A Revision 1, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths , November 2015, https://doi.org/10.6028/NIST.SP.800-131Ar1 .

[SP 800-132] NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation , December 2010, https://doi.org/10.6028/NIST.SP.800-132 .

[SP 800-185] NIST Special Publication 800-185, SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash, and ParallelHash , December 2016, https://doi.org/10.6028/NIST.SP.800-185 .

Federal Information Processing Standards

[FIPS 140-2] Federal Information Processing Standard Publication 140-2, Security Requirements for Cryptographic Modules , May 25, 2001 (with Change Notices through December 3, 2002), https://doi.org/10.6028/NIST.FIPS.140-2 .

[FIPS 198-1] Federal Information Processing Standard Publication 198-1, The Keyed-Hash Message Authentication Code (HMAC) , July 2008, https://doi.org/10.6028/NIST.FIPS.198-1 . [FIPS 201] Federal Information Processing Standard Publication 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors , August 2013, https://doi.org/10.6028/NIST.FIPS.201-2 .

[FIPS 202] Federal Information Processing Standard Publication 202, SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions , August 2015, https://doi.org/10.6028/NIST.FIPS.202 . Appendix A—Strength of Memorized Secrets

This appendix is informative.

Throughout this appendix, the word “password” is used for ease of discussion. Where used, it should be interpreted to include passphrases and PINs as well as passwords.