RE: Password complexity - improvement


On 15 Aug 2007 at 18:46, Jackson, Eric R IT3 (CVN75 CS-3) wrote:

You're absolutely wrong in your statement here. Enforcing passwords
that MUST consist of uppercase letters, lowercase letter, numbers AND
special characters INCREASES the total number of possible passwords;
which in turn has a positive impact on your security.

Eric, I am sure you are the one who is wrong ;-)

1.
Even if you do not enforce this policy, no one is forbidden to use complex
passwords, so how does enforcing the policy increase the number of possible
passwords?

2.
In fact, the number of posibilities DO decrease with this policy.

Example A:
Let us assume you have a policy which enforces uppercase, lowercase and
numbers, and a password length of 3.
For one character, you have 26+26+10 = 62 possibilities
For the next character, you have 26+10 = 32 possibilities left
For the third character, you have 10 possibilities left
So you have a total of 62*32*10 possibilities WITH enforced complexity

Example B:
Let us assume you have no special policy regarding the complexity, but also a
password length of 3.
For the first character, you have 26+26+10 = 62 possibilities
For the second character, you have 26+26+10 = 62 possibilities
For the third character, you have 26+26+10 = 62 possibilities
So you have a total of 62*62*62 possibilities WITHOUT enforced complexity

Of course, a length of 3 chars is only for demonstration purposes here ;-)

Have fun

Frank Heyne

Relevant Pages

  • Re: Password hashes
    ... There is no such thing as an NTLMV2 hash. ... While I am a believer of enforcing complex passwords the bigger issue is if ... computers you need to review the physical security of your computers. ... > broken up into two 7 character units. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: [Full-Disclosure] Senior M$ member says stop using passwords completely!
    ... hash security. ... > generating dictionary lists using different character sets for the ... secure or it isn't, for the level of computation possible by today's ... Yes, good passwords are always a must, along with a good ...
    (Full-Disclosure)
  • Re: Password Security Policy Question
    ... > specific character in people's passwords to being a numeric character. ... I am confused at this policy. ...
    (Bugtraq)
  • Re: Someone said 256 bits is not enough
    ... the "chosen by humans" in "passphrases chosen by humans are not ... Considering about 4 bits entropy per character ... I would like to ask about passwords for myself. ...
    (sci.crypt)
  • Re: Password Security Policy Question
    ... L. Adrian Griffis wrote: ... > specific character in people's passwords to being a numeric character. ... I am confused at this policy. ...
    (Bugtraq)