Password Policy

Audience: Administrators, Security Officers
Time: ~10 min
Prerequisites: Super Administrator access; ability to set Control Plane API environment variables

Control Core v3.4 stores operator passwords with Argon2id and rejects passwords known from public breaches.

Argon2id hashing

New and upgraded passwords use Argon2id with defence-grade parameters:

Parameter	Value
Memory	65536 KiB (64 MiB)
Iterations (time cost)	3
Parallelism	4

Legacy bcrypt hashes remain valid. On the next successful login, passwords are transparently re-hashed to Argon2id without operator action.

Troubleshooting: If login is slow after upgrade, Argon2id intentionally costs CPU/memory — expect sub-second verify on modern hardware. Persistent login failures after migration usually indicate wrong password, not hashing upgrade.

Breached-password check (k-anonymity)

Before accepting a new password, the Control Plane checks whether it appears in known breach corpora:

Online (default): HIBP Range API — only the first 5 characters of the SHA-1 hash leave your environment.
Air-gapped: Set BREACH_CHECK_LOCAL_FILE to a local hash list.
Disable (not recommended): BREACH_CHECK_DISABLED=true

Warning: Set BREACH_CHECK_DISABLED=true only under guidance from Control Core support (support@controlcore.io). Disabling breach checks weakens password policy enforcement and may affect your SOC 2 compliance posture.

Fail closed when offline: BREACH_CHECK_FAIL_CLOSED=true

Rejected passwords return error code PASSWORD_EXPOSED_IN_PUBLIC_BREACH (HTTP 400).

Troubleshooting: If password change fails with PASSWORD_EXPOSED_IN_PUBLIC_BREACH, choose a unique password not reused from other services. If legitimate passwords fail in air-gapped mode, verify the local file format (full SHA-1 hex or HIBP suffix lines).

Operator checklist

Force password rotation for local accounts after incident response.
Disable password authentication when SSO is authoritative (Settings → Users → Authentication Methods).
Set strong INITIAL_ADMIN_PASSWORD / CC_BUILTIN_ADMIN_PASS at first boot — never rely on documented defaults in production.
Combine password policy with MFA for defense in depth.

Environment reference

Variable	Purpose
`BREACH_CHECK_LOCAL_FILE`	Air-gapped breach corpus path
`BREACH_CHECK_DISABLED`	Skip breach check
`BREACH_CHECK_FAIL_CLOSED`	Reject password set when check unavailable

Next steps

Authentication overview — full v3.4 capability map
SSO with SAML & OIDC — eliminate passwords for most users
Built-in admin recovery — break-glass password reset