IA-5(1)

Password-based Authentication

NIST · SP 800-53 Revision 5 v1.4.0

For password-based authentication:

(a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;

(b) Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);

(c) Transmit passwords only over cryptographically-protected channels;

(d) Store passwords using an approved salted key derivation function, preferably using a keyed hash;

(e) Require immediate selection of a new password upon account recovery;

(f) Allow user selection of long passwords and passphrases, including spaces and all printable characters;

(g) Employ automated tools to assist the user in selecting strong password authenticators; and

(h) Enforce the following composition and complexity rules: [composition and complexity rules].

Identification and Authentication

Components addressing IA-5(1)

Debian 13 Password Hashing Component Definition 1.0.0 technically-tested unpublished

partial

This component claims only IA-5(1)(d), password storage. The other elements of IA-5(1) are claimed by debian-13-pam-pwquality, or by no component; see debian-13-passphrase-hardening.

StatementStatusDescription
(d)implementedPasswords are stored using yescrypt, a salted, memory-hard key derivation function: pam_unix.so names yescrypt in /etc/pam.d/common-password, and /etc/login.defs sets ENCRYPT_METHOD YESCRYPT. Verified by inspecting the hash stored when a…

Configuration and scripts

Debian 13 pam_pwquality Enforcement Base Component Definition 1.0.0 technically-tested unpublished

partial

This component claims the IA-5(1) elements that follow from pam_pwquality being installed and enforcing: every password change is checked, long passphrases and the full printable character set are accepted, and password tooling is available. The content rules themselves are claimed by the rule components that own them.

StatementStatusDescription
(b)implementedpam_pwquality runs as 'requisite' in the password stack, so every password creation and change is checked against the dictionary before pam_unix is reached.
(f)implementedNo maximum length and no character-set restriction are configured, and yescrypt does not truncate. Long passphrases including spaces and the full ASCII printable range are accepted. Verified at 72 characters and across the ASCII printable…
(g)implementedlibpwquality-tools provides pwmake(1), which generates high-entropy candidates, and pwscore(1), which scores a candidate against the live policy. Both are installed by the apply script.

Configuration and scripts

Debian 13 ISM Dictionary Checking Component Definition 1.0.0 technically-tested unpublished

partial

This component claims only IA-5(1)(a), the list of commonly used, expected or compromised passwords, and binds the parameter for how often that list is updated.

StatementStatusDescription
(a)partialdictcheck = 1 evaluates candidates against the cracklib dictionary, and the refresh cadence is bound to ia-05.01_odp.01. Measured effectiveness is low: 1 of 8 long common passwords was rejected at minlen 15. cracklib is a common-word…

Configuration and scripts

This control's implementations as an OSCAL component definition (newest version of each component)