3.5.10: Store and transmit only cryptographically-protected passwords

Control Family:

Identification and Authentication

Control Type:

Derived

CSF v1.1 References:

PR.AC-1

Control is withdrawn in the next version of this control set and incorporated into: 03.05.07: Password Management.

Discussion

Cryptographically-protected passwords use salted one-way cryptographic hashes of passwords. See [NIST CRYPTO].