4 ms·

Way earlier than that, even. > Verifiers SHOULD NOT impose other composition rules (mixtures of different character types, for example) on memorized secrets E

by gkop 5y ago

Way earlier than that, even. > Verifiers SHOULD NOT impose other composition rules (mixtures of different character types, for example) on memorized secrets Earliest draft in Wayback Machine, dated June 2016. Lots of other good stuff from 800-63 dates back this early too. https://web.archive.org/web/20160624033024/https://pages.nist.gov/800-63-3/sp800-63b.html https://web.archive.org/web/20160624033024/https://pages.nis...

dragonwriter 5y ago
SHOULD NOT and MUST NOT are very different from a compliance perspective. The former usually means something between nothing at all and “you can do it but you have to write paperwork that no one will actually read in detail, but someone will maybe check the existence of, if you do”. The latter means “do it and you are noncompliant”.
- dllthomas 5y ago
  https://datatracker.ietf.org/doc/html/rfc2119 https://datatracker.ietf.org/doc/html/rfc2119 is a good reference, although those precise definitions may or many not be in effect in any particular situation (including this one). See also https://datatracker.ietf.org/doc/html/rfc6919 https://datatracker.ietf.org/doc/html/rfc6919
- gkop 5y ago
  Thanks for pointing out the improvement over NIST, it wasn’t clear to me. But did you mean to reply to my parent? Both the draft and the current language say SHOULD NOT. I’d rather “must”, but will settle for “should”; the NIST docs have certainly made my work easier. Hopefully NIST improves, and perhaps this memo will help! The essential purpose of my comment was only to correct my parent on the date.
wslack 5y ago
They accepted edits via pull request when that was in the works! [1] Such a better model of giving feedback or suggesting edits compared to sending in a marked-up PDF. [1]: https://github.com/usnistgov/800-63-3/pull/576 https://github.com/usnistgov/800-63-3/pull/576

by gkop 5y ago

dragonwriter 5y ago

SHOULD NOT and MUST NOT are very different from a compliance perspective. The former usually means something between nothing at all and “you can do it but you have to write paperwork that no one will actually read in detail, but someone will maybe check the existence of, if you do”. The latter means “do it and you are noncompliant”.

dllthomas 5y ago
https://datatracker.ietf.org/doc/html/rfc2119 https://datatracker.ietf.org/doc/html/rfc2119 is a good reference, although those precise definitions may or many not be in effect in any particular situation (including this one). See also https://datatracker.ietf.org/doc/html/rfc6919 https://datatracker.ietf.org/doc/html/rfc6919
gkop 5y ago
Thanks for pointing out the improvement over NIST, it wasn’t clear to me. But did you mean to reply to my parent? Both the draft and the current language say SHOULD NOT. I’d rather “must”, but will settle for “should”; the NIST docs have certainly made my work easier. Hopefully NIST improves, and perhaps this memo will help! The essential purpose of my comment was only to correct my parent on the date.

wslack 5y ago

They accepted edits via pull request when that was in the works! [1] Such a better model of giving feedback or suggesting edits compared to sending in a marked-up PDF. [1]: https://github.com/usnistgov/800-63-3/pull/576 https://github.com/usnistgov/800-63-3/pull/576