A Comparative Analysis of NIST SP 800-63B-4 2pd(2024) and Domestic Password Policies

This paper presents a comparative analysis of the latest password management policies outlined in NIST SP 800-63B-4 2pd(2024) and those in the Password Selection and Usage Guidelines (2019) and the National Security Standard Guidelines (2023).South Korea's current password management policies are believed to have evolved based on NIST SP 800-63(2004), and the need to reflect the changes introduced in NIST SP 800-63B-4 2pd(2024) has emerged.This study identifies the differences and similarities between international standards and domestic policies and suggests directions for improving the domestic password management framework.Key differences include NIST's emphasis on password length over complexity and its recommendation against mandatory periodic password updates.Additionally, NIST highlights the importance of multi-factor authentication (MFA), whereas domestic policies still mandate complex passwords and require periodic updates, with MFA mainly limited to high-risk systems.This study examines the applicability of NIST SP 800-63B-4 2pd(2024), explores how reducing password update frequency can improve user convenience, discusses the expansion of MFA, and considers the adoption of password management tools and blacklists to prevent the use of weak passwords.Finally, it proposes tailored policy suggestions for aligning domestic practices with international standards while balancing security and usability.These improvements are expected to enhance the effectiveness and security of password management practices in South Korea.