title: DoD Password Complexity: Users cannot reuse any of their previous X passwords
body: <p>I have seen a couple of posts on this, but I haven't seen a definitive answer necessarily. Therefore, I thought I would try to restate the question in a new context (Department of Defense).</p>
  
  <p>According to DISA's "<strong><em><a href="http://iase.disa.mil/stigs/a-z.html" rel="nofollow noreferrer">Application Security and Development STIG, V3R2</a></em></strong>", section <strong>3.1.24.2 Password Complexity and Maintenance</strong>, DoD enterprise software has a pretty tough guideline with passwords:</p>
  
  <ul>
  <li><p>Passwords must be at least 15 characters long.</p></li>
  <li><p>Passwords must contain a mix of upper case letters, lower case letters, numbers, and special characters. </p></li>
  <li><p>When a password is changed, users must not be
  able to use personal information such as names, telephone numbers,
  account names, or dictionary words. </p></li>
  <li><p>Passwords must expire after 60
  days. </p></li>
  <li><p>Users must not be able to reuse any of their previous 10
  passwords. </p></li>
  <li><p>Ensure that the application has the capability to require that new account passwords differ from the previous password by at least four characters when a password is changed.</p></li>
  <li><p>Users must not be able to change passwords more than
  once a day, except in the case of an administrator or a privileged
  user. Privileged users may be required to reset a user’s forgotten
  passwords and the ability to change passwords more than once per day.</p></li>
  </ul>
  
  <p>As stated in <a href="https://stackoverflow.com/questions/7265782/checking-password-complexity-different-from-last-x-passwords">NullUserException's post</a>, for the developer to actually be able to check for the last X amount of passwords (and also ensure that new passwords differ from the previous password [<strong>bullet 6</strong>]), the passwords would have to be encrypted using a reversible method, rather than hashing a password (which is a lot more unsecure, even if I am using NSA approved encryption algorithms). The proposed answer seemed to make a deal of sense, although there seemed to be some discrepancies and arguments, as seen in <a href="https://stackoverflow.com/questions/457471/password-complexity-strategies-any-evidence-for-them">Dan Vinton's post</a>.</p>
  
  <p>I guess the real question here is, <em>has anyone been able to implement all of these seemingly common password complexity constraints without actually diminishing the security of their systems</em>?</p>
  
  <hr>
  
  <p><strong>Edit:</strong> Vulnerability APP3320.7 (bullet point 6) states "Ensure that the application has the capability to require that new account passwords differ from the previous password by at least four characters when a password is changed." That lead me to believe that I would have to run a string similarity algorithm such as Levenshtein to check similarity. I cannot do this on a hash/salt. Please let me know if I am wrong here?</p>