# RE: Password complexity - improvement

On 15 Aug 2007 at 18:46, Jackson, Eric R IT3 (CVN75 CS-3) wrote:

that MUST consist of uppercase letters, lowercase letter, numbers AND
special characters INCREASES the total number of possible passwords;
which in turn has a positive impact on your security.

Eric, I am sure you are the one who is wrong ;-)

1.
Even if you do not enforce this policy, no one is forbidden to use complex
passwords, so how does enforcing the policy increase the number of possible

2.
In fact, the number of posibilities DO decrease with this policy.

Example A:
Let us assume you have a policy which enforces uppercase, lowercase and
numbers, and a password length of 3.
For one character, you have 26+26+10 = 62 possibilities
For the next character, you have 26+10 = 32 possibilities left
For the third character, you have 10 possibilities left
So you have a total of 62*32*10 possibilities WITH enforced complexity

Example B:
Let us assume you have no special policy regarding the complexity, but also a
For the first character, you have 26+26+10 = 62 possibilities
For the second character, you have 26+26+10 = 62 possibilities
For the third character, you have 26+26+10 = 62 possibilities
So you have a total of 62*62*62 possibilities WITHOUT enforced complexity

Of course, a length of 3 chars is only for demonstration purposes here ;-)

Have fun

Frank Heyne

## Relevant Pages

... There is no such thing as an NTLMV2 hash. ... While I am a believer of enforcing complex passwords the bigger issue is if ... computers you need to review the physical security of your computers. ... > broken up into two 7 character units. ...