{
  "component-definition": {
    "uuid": "9e9f92fc-8682-4cd4-ac47-46afeb6b1cd3",
    "metadata": {
      "title": "Debian 13 Password Hashing Component Definition",
      "last-modified": "2026-09-15T00:00:00Z",
      "version": "1.0.0",
      "oscal-version": "1.1.2",
      "roles": [
        {
          "id": "system-administrator",
          "title": "System Administrator"
        },
        {
          "id": "system-security-officer",
          "title": "System Security Officer"
        }
      ],
      "parties": [
        {
          "uuid": "1b4346aa-044e-4e42-a524-53d40f60f879",
          "type": "organization",
          "name": "Platform Operations"
        }
      ],
      "responsible-parties": [
        {
          "role-id": "system-administrator",
          "party-uuids": [
            "1b4346aa-044e-4e42-a524-53d40f60f879"
          ]
        },
        {
          "role-id": "system-security-officer",
          "party-uuids": [
            "1b4346aa-044e-4e42-a524-53d40f60f879"
          ]
        }
      ],
      "remarks": "Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.\n\nAssurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.",
      "document-ids": [
        {
          "scheme": "https://ns.oscalops.net/component-definitions",
          "identifier": "debian-13-password-hashing"
        }
      ],
      "props": [
        {
          "name": "assurance-state",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "technically-tested"
        },
        {
          "name": "assurance-authority",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "none; self-asserted by the contributing author"
        },
        {
          "name": "endorsement",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "none"
        },
        {
          "name": "publisher",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "library_component-definition contributors"
        },
        {
          "name": "publication-status",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "unpublished"
        },
        {
          "name": "artifact-slug",
          "ns": "https://ns.oscalops.net/component-definitions",
          "value": "debian-13-password-hashing"
        }
      ],
      "links": [
        {
          "href": "https://library.oscalops.net/component-definitions/debian-13-password-hashing/1.0.0/component-definition.json",
          "rel": "canonical",
          "text": "Reserved canonical URL; the registry is not yet published"
        }
      ]
    },
    "components": [
      {
        "uuid": "85e7add0-7c26-40a8-8147-8ab63ad5e29e",
        "type": "software",
        "title": "Debian 13 password hashing (yescrypt)",
        "description": "Passwords on Debian 13 (trixie) are stored as yescrypt hashes: a salted, memory-hard key derivation function. pam_unix hashes password changes made through PAM with its yescrypt option, and tools that bypass PAM follow ENCRYPT_METHOD YESCRYPT in /etc/login.defs.\n\nBoth are Debian 13 defaults. This component configures nothing: it asserts the defaults and ships a verification script that makes the assertion checkable, including by inspecting a hash actually stored for a throwaway account.",
        "purpose": "Evidence that stored passwords use an approved, salted key derivation function (IA-5(1)(d)).",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "login.defs:ENCRYPT_METHOD"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pam_unix:hashing-algorithm"
          },
          {
            "name": "configuration",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-password-hashing",
            "value": "none; asserts Debian 13 defaults"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          },
          {
            "role-id": "system-security-officer",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "92fd3572-d0b4-4aef-8220-24bd23393dbc",
            "source": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
            "description": "The SP 800-53 Rev 5 IA-5(1) password-storage statement, from oscal-content release v1.4.0.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v1.4.0"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "NIST"
              }
            ],
            "links": [
              {
                "href": "#afd178e1-5b19-45b3-8179-db808eae36de",
                "rel": "reference",
                "text": "Pinned SP 800-53 catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "5c9c80ad-6aff-4c4d-9fa2-d10d7689f2dd",
                "control-id": "ia-5.1",
                "description": "This component claims only IA-5(1)(d), password storage. The other elements of IA-5(1) are claimed by debian-13-pam-pwquality, or by no component; see debian-13-passphrase-hardening.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "partial"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  }
                ],
                "links": [
                  {
                    "href": "#ee16f362-2b86-4dbd-9e25-c7be0d099b92",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "statements": [
                  {
                    "statement-id": "ia-5.1_smt.d",
                    "uuid": "2f1df235-3eda-5131-84cd-0f93adf92e48",
                    "description": "Passwords are stored using yescrypt, a salted, memory-hard key derivation function: pam_unix.so names yescrypt in /etc/pam.d/common-password, and /etc/login.defs sets ENCRYPT_METHOD YESCRYPT. Verified by inspecting the hash stored when a password is set on a throwaway account.",
                    "props": [
                      {
                        "name": "implementation-status",
                        "ns": "https://ns.oscalops.net/component-definitions",
                        "value": "implemented"
                      }
                    ],
                    "responsible-roles": [
                      {
                        "role-id": "system-administrator",
                        "party-uuids": [
                          "1b4346aa-044e-4e42-a524-53d40f60f879"
                        ]
                      }
                    ],
                    "remarks": "yescrypt is the Debian 13 default and is retained rather than changed; the component asserts and verifies it rather than configuring it."
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      }
    ],
    "back-matter": {
      "resources": [
        {
          "uuid": "ee16f362-2b86-4dbd-9e25-c7be0d099b92",
          "title": "Verification script",
          "description": "Checks that pam_unix and /etc/login.defs select yescrypt; with --with-test-account, sets a password on a throwaway account and checks the stored hash is yescrypt. Configures nothing.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "scripts/verify-password-hashing.sh",
              "media-type": "text/plain"
            }
          ],
          "base64": {
            "filename": "verify-password-hashing.sh",
            "media-type": "text/plain",
            "value": "IyEvYmluL3NoCiMgVmVyaWZ5IHRoYXQgYSBEZWJpYW4gMTMgKHRyaXhpZSkgaG9zdCBzdG9yZXMgcGFzc3dvcmRzIHdpdGggeWVzY3J5cHQsIGEgc2FsdGVkLAojIG1lbW9yeS1oYXJkIGtleSBkZXJpdmF0aW9uIGZ1bmN0aW9uIChJQS01KDEpKGQpKS4KIwojIERlYmlhbiAxMyBhbHJlYWR5IGRvZXMgdGhpcywgc28gdGhlIGNvbXBvbmVudCBjb25maWd1cmVzIG5vdGhpbmc6IGl0IGFzc2VydHMgdGhlCiMgZGVmYXVsdCBhbmQgbWFrZXMgdGhlIGFzc2VydGlvbiBjaGVja2FibGUuIFBhc3N3b3JkIGNoYW5nZXMgdGhyb3VnaCBQQU0gYXJlCiMgaGFzaGVkIGJ5IHBhbV91bml4J3Mgb3duIG9wdGlvbjsgdG9vbHMgdGhhdCBieXBhc3MgUEFNIHVzZSBFTkNSWVBUX01FVEhPRCBpbgojIC9ldGMvbG9naW4uZGVmcy4gQm90aCBhcmUgaW5zcGVjdGVkLgojCiMgQnkgZGVmYXVsdCBubyBhY2NvdW50IGlzIGNyZWF0ZWQgb3IgbW9kaWZpZWQsIHNvIHRoaXMgaXMgc2FmZSBvbiBhIHByb2R1Y3Rpb24KIyBob3N0LiAtLXdpdGgtdGVzdC1hY2NvdW50IGFsc28gc2V0cyBhIHBhc3N3b3JkIG9uIGEgdGhyb3dhd2F5IGFjY291bnQgYW5kIGNoZWNrcwojIHRoZSBoYXNoIGFjdHVhbGx5IHN0b3JlZCwgd2hpY2ggaXMgdGhlIG9ubHkgYmVoYXZpb3VyYWwgdGVzdC4KIwojIEV4aXQgc3RhdHVzOiAwIGlmIG5vdGhpbmcgRkFJTHMsIDEgb3RoZXJ3aXNlLgoKc2V0IC11CgpXSVRIX1RFU1RfQUNDT1VOVD0wClsgIiR7MTotfSIgPSAiLS13aXRoLXRlc3QtYWNjb3VudCIgXSAmJiBXSVRIX1RFU1RfQUNDT1VOVD0xCgpQQVNTX0NPVU5UPTAKRkFJTF9DT1VOVD0wCgpyZXBvcnQoKSB7CgljYXNlICIkMSIgaW4KCQlQQVNTKSBQQVNTX0NPVU5UPSQoKFBBU1NfQ09VTlQgKyAxKSkgOzsKCQkqKSBGQUlMX0NPVU5UPSQoKEZBSUxfQ09VTlQgKyAxKSkgOzsKCWVzYWMKCXByaW50ZiAnJS04cyAlLTEzcyAlc1xuJyAiJDEiICIkMiIgIiQzIgp9CgpDT05GSUdfT0s9MQppZiBncmVwIC1xRSAnXlteI10qcGFtX3VuaXhcLnNvLipbWzpzcGFjZTpdXXllc2NyeXB0KFtbOnNwYWNlOl1dfCQpJyAvZXRjL3BhbS5kL2NvbW1vbi1wYXNzd29yZDsgdGhlbgoJcmVwb3J0IFBBU1MgInBhbV91bml4IiAicGFtX3VuaXguc28gaGFzaGVzIHdpdGggeWVzY3J5cHQgaW4gL2V0Yy9wYW0uZC9jb21tb24tcGFzc3dvcmQiCmVsc2UKCUNPTkZJR19PSz0wCglyZXBvcnQgRkFJTCAicGFtX3VuaXgiICJwYW1fdW5peC5zbyBpbiAvZXRjL3BhbS5kL2NvbW1vbi1wYXNzd29yZCBkb2VzIG5vdCBuYW1lIHllc2NyeXB0IgpmaQppZiBncmVwIC1xRSAnXltbOnNwYWNlOl1dKkVOQ1JZUFRfTUVUSE9EW1s6c3BhY2U6XV0rWUVTQ1JZUFQnIC9ldGMvbG9naW4uZGVmczsgdGhlbgoJcmVwb3J0IFBBU1MgImxvZ2luLmRlZnMiICJFTkNSWVBUX01FVEhPRCBZRVNDUllQVCBpbiAvZXRjL2xvZ2luLmRlZnMiCmVsc2UKCUNPTkZJR19PSz0wCglyZXBvcnQgRkFJTCAibG9naW4uZGVmcyIgIkVOQ1JZUFRfTUVUSE9EIGlzIG5vdCBZRVNDUllQVCBpbiAvZXRjL2xvZ2luLmRlZnMiCmZpCgppZiBbICIkV0lUSF9URVNUX0FDQ09VTlQiIC1lcSAxIF07IHRoZW4KCSMgTG9uZyBlbm91Z2gsIGFuZCBmcmVlIG9mIHdvcmRzLCBydW5zIGFuZCByZXBlYXRzLCBmb3IgYW55IHBhc3N3b3JkIHBvbGljeQoJIyBhbm90aGVyIGNvbXBvbmVudCBtYXkgaGF2ZSBhcHBsaWVkLgoJVEVTVF9VU0VSPSJpc21oYXNoJCQiCglpZiB1c2VyYWRkIC1NIC1zIC91c3Ivc2Jpbi9ub2xvZ2luICIkVEVTVF9VU0VSIiA+L2Rldi9udWxsIDI+JjEgJiYKCQllY2hvICIkVEVTVF9VU0VSOnZhdWx0b3R0ZXJtYW5nb3F1aWx0cmF2ZW5mam9yZHplYnJhcGxpbnRoIiB8IGNocGFzc3dkID4vZGV2L251bGwgMj4mMTsgdGhlbgoJCUhBU0g9JChnZXRlbnQgc2hhZG93ICIkVEVTVF9VU0VSIiB8IGN1dCAtZDogLWYyKQoJCXVzZXJkZWwgLWYgIiRURVNUX1VTRVIiID4vZGV2L251bGwgMj4mMQoJCWNhc2UgIiRIQVNIIiBpbgoJCQknJHkkJyopIHJlcG9ydCBQQVNTICJpYS01LjFfc210LmQiICJhIHBhc3N3b3JkIHNldCB0aHJvdWdoIFBBTSBpcyBzdG9yZWQgYXMgYSB5ZXNjcnlwdCBoYXNoIiA7OwoJCQkqKSAgICAgIHJlcG9ydCBGQUlMICJpYS01LjFfc210LmQiICJhIHBhc3N3b3JkIHNldCB0aHJvdWdoIFBBTSBpcyBzdG9yZWQgYXMgJyQocHJpbnRmICclcycgIiRIQVNIIiB8IGN1dCAtYzEtNCkuLi4nLCBub3QgeWVzY3J5cHQiIDs7CgkJZXNhYwoJZWxzZQoJCXVzZXJkZWwgLWYgIiRURVNUX1VTRVIiID4vZGV2L251bGwgMj4mMQoJCXJlcG9ydCBGQUlMICJpYS01LjFfc210LmQiICJjb3VsZCBub3Qgc2V0IGEgcGFzc3dvcmQgb24gYSB0aHJvd2F3YXkgYWNjb3VudCB0byB0ZXN0IHdpdGgiCglmaQplbGlmIFsgIiRDT05GSUdfT0siIC1lcSAxIF07IHRoZW4KCXJlcG9ydCBQQVNTICJpYS01LjFfc210LmQiICJjb25maWd1cmVkIGZvciB5ZXNjcnlwdCAocmUtcnVuIHdpdGggLS13aXRoLXRlc3QtYWNjb3VudCB0byBjaGVjayBhIHN0b3JlZCBoYXNoKSIKZWxzZQoJcmVwb3J0IEZBSUwgImlhLTUuMV9zbXQuZCIgIm5vdCBjb25maWd1cmVkIGZvciB5ZXNjcnlwdCIKZmkKCmVjaG8KZWNobyAicGFzc2VkOiAkUEFTU19DT1VOVCAgZmFpbGVkOiAkRkFJTF9DT1VOVCIKWyAiJEZBSUxfQ09VTlQiIC1lcSAwIF0gfHwgZXhpdCAxCg=="
          }
        },
        {
          "uuid": "afd178e1-5b19-45b3-8179-db808eae36de",
          "title": "NIST SP 800-53 Rev 5 catalogue (oscal-content v1.4.0)",
          "description": "NIST SP 800-53 Revision 5 catalogue, release v1.4.0: the release this document's control identifiers resolve against.",
          "props": [
            {
              "name": "release-tag",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "v1.4.0"
            },
            {
              "name": "sha256",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "1645df6a370dcb931db2e2d5d70c2f77bc89c38499a416c23a70eb2c0e595bcc"
            }
          ],
          "rlinks": [
            {
              "href": "https://raw.githubusercontent.com/usnistgov/oscal-content/v1.4.0/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
              "media-type": "application/json"
            }
          ]
        }
      ]
    }
  }
}