# RE: Password complexity - improvement

*From*: "Frank Heyne" <fh@xxxxxxxxxxxxxxxxxxxxx>*Date*: Thu, 16 Aug 2007 20:12:32 +0200

On 15 Aug 2007 at 18:46, Jackson, Eric R IT3 (CVN75 CS-3) wrote:

You're absolutely wrong in your statement here. Enforcing passwords

that MUST consist of uppercase letters, lowercase letter, numbers AND

special characters INCREASES the total number of possible passwords;

which in turn has a positive impact on your security.

Eric, I am sure you are the one who is wrong ;-)

1.

Even if you do not enforce this policy, no one is forbidden to use complex

passwords, so how does enforcing the policy increase the number of possible

passwords?

2.

In fact, the number of posibilities DO decrease with this policy.

Example A:

Let us assume you have a policy which enforces uppercase, lowercase and

numbers, and a password length of 3.

For one character, you have 26+26+10 = 62 possibilities

For the next character, you have 26+10 = 32 possibilities left

For the third character, you have 10 possibilities left

So you have a total of 62*32*10 possibilities WITH enforced complexity

Example B:

Let us assume you have no special policy regarding the complexity, but also a

password length of 3.

For the first character, you have 26+26+10 = 62 possibilities

For the second character, you have 26+26+10 = 62 possibilities

For the third character, you have 26+26+10 = 62 possibilities

So you have a total of 62*62*62 possibilities WITHOUT enforced complexity

Of course, a length of 3 chars is only for demonstration purposes here ;-)

Have fun

Frank Heyne

**References**:**RE: Password complexity - improvement***From:*Jackson, Eric R IT3 (CVN75 CS-3)

- Prev by Date:
**RE: Password complexity - improvement** - Next by Date:
**RE: Password complexity - improvement** - Previous by thread:
**RE: Password complexity - improvement** - Index(es):