BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1.5.3.8 Passwords

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
modified 8 Transition: A transition plan should be developed and followed so that the changeover part of 8.1.5.3

Title

Passwords

Control changed

Before · SP 800-57 Part 1 Rev. 4

Passwords are used for identity authentication or authorization, and, in some cases, to derive keying material (see [SP800-132] ). Passwords may be distributed, but their protection during distribution shall be consistent with the protection required for their use. For example, if the password will be used to access cryptographic keys that are used to provide 128 bits of security strength when protecting data, then the password needs to be provided with at least 128 bits of protection as well. Note that poorly selected passwords may not themselves provide the required amount of protection for key access and are potentially the weak point of the process; i.e., it may be far easier to guess the password than to attempt to “break” the cryptographic protection used on the password. It is the responsibility of users and organizations to select passwords that provide the requisite amount of protection for the keys they protect.

After · SP 800-57 Part 1 Rev. 5

Passwords are used for identity authentication or, authorization, and, in some cases, to derive keying material (see [SP800-132]SP 800-132 ). Passwords may be distributed, but their protection during distribution shall be consistent with the protection required for their use. For example, if the password will be used to access cryptographic keys that are used to provide 128 bits of security strength when protecting data, then the password needs to be provided with at least 128 bits of protection as well. Note that poorly selected passwords alone may not themselves provide the required amount of protection for key access and are potentially the weak point of the process; (i.e., it may be far easier to guess the password than to attempt to “break” the cryptographic protection used on the password). It is the responsibility of users and organizations to select passwords that provide the requisite amount of protection for the keys they protect.