RE: Password complexity  improvement
 From: "Frank Heyne" <fh@xxxxxxxxxxxxxxxxxxxxx>
 Date: Thu, 16 Aug 2007 20:12:32 +0200
On 15 Aug 2007 at 18:46, Jackson, Eric R IT3 (CVN75 CS3) wrote:
You're absolutely wrong in your statement here. Enforcing passwords
that MUST consist of uppercase letters, lowercase letter, numbers AND
special characters INCREASES the total number of possible passwords;
which in turn has a positive impact on your security.
Eric, I am sure you are the one who is wrong ;)
1.
Even if you do not enforce this policy, no one is forbidden to use complex
passwords, so how does enforcing the policy increase the number of possible
passwords?
2.
In fact, the number of posibilities DO decrease with this policy.
Example A:
Let us assume you have a policy which enforces uppercase, lowercase and
numbers, and a password length of 3.
For one character, you have 26+26+10 = 62 possibilities
For the next character, you have 26+10 = 32 possibilities left
For the third character, you have 10 possibilities left
So you have a total of 62*32*10 possibilities WITH enforced complexity
Example B:
Let us assume you have no special policy regarding the complexity, but also a
password length of 3.
For the first character, you have 26+26+10 = 62 possibilities
For the second character, you have 26+26+10 = 62 possibilities
For the third character, you have 26+26+10 = 62 possibilities
So you have a total of 62*62*62 possibilities WITHOUT enforced complexity
Of course, a length of 3 chars is only for demonstration purposes here ;)
Have fun
Frank Heyne
 References:
 RE: Password complexity  improvement
 From: Jackson, Eric R IT3 (CVN75 CS3)
 RE: Password complexity  improvement
 Prev by Date: RE: Password complexity  improvement
 Next by Date: RE: Password complexity  improvement
 Previous by thread: RE: Password complexity  improvement
 Index(es):
Relevant Pages
