ETSI EN 303 645 Default passwords for consumer IoT products

Provision 5.1-1 applies where passwords authenticate users against the device or provide machine-to-machine authentication. In every state other than factory default, all device passwords must be unique per device or defined by the user. A universal value such as "admin" cannot remain usable as an operational password after initialization.

The standard permits unique pre-installed passwords, a user-selected password during initialization, or another authentication method that does not use passwords. Standard pairing codes are not treated as machine-to-machine passwords. V3.1.3 separately recommends that passwords not be used for machine-to-machine authentication and requires applicable authentication mechanisms to use best-practice cryptography.

Apply the test to every password-bearing path. Check local administration, remote APIs, network protocols, companion-app handoffs, service credentials used by the device, initialization, recovery, and factory reset. Record which state each credential is usable in and whether reset restores a unique value or forces a user-defined value before normal operation.

Provision 5.1-2 applies when pre-installed unique per-device passwords are used. The generation mechanism must reduce the risk of automated attacks against a class or type of device, so the evidence has to cover the generation method, not only a sample label or onboarding screenshot.

ETSI gives examples of weak patterns to avoid: incremental counters, common strings, and passwords obviously related to public information such as MAC addresses or Wi-Fi SSIDs. TS 103 701 turns that into conceptual checks on regularities, common patterns, relationship to public information, and appropriate complexity.

Default-password work is only one part of clause 5.1. If a user can authenticate against the device, provision 5.1-4 requires a simple way for the user or an administrator to change the authentication value, whether that value is a password, PIN, biometric, or other token. Provision 5.1-5 requires a mechanism that makes successful brute-force attacks through network interfaces impracticable unless a resource constraint determined by the use case prevents implementation.

For an assessment, TS 103 701 expects the supplier organization to complete ICS and IXIT information so the test laboratory can derive a test plan. Incomplete IXIT information can lead to an inconclusive test result because the test case cannot be properly executed.