RE: Password complexity - improvement

On 15 Aug 2007 at 18:46, Jackson, Eric R IT3 (CVN75 CS-3) wrote:

> You're absolutely wrong in your statement here.  Enforcing passwords
> that MUST consist of uppercase letters, lowercase letter, numbers AND
> special characters INCREASES the total number of possible passwords;
> which in turn has a positive impact on your security.

Eric, I am sure you are the one who is wrong ;-)

1. 
Even if you do not enforce this policy, no one is forbidden to use complex 
passwords, so how does enforcing the policy increase the number of possible 
passwords?

2.
In fact, the number of posibilities DO decrease with this policy. 

Example A:
Let us assume you have a policy which enforces uppercase, lowercase and 
numbers, and a password length of 3. 
For one character, you have 26+26+10 = 62 possibilities
For the next character, you have 26+10 = 32 possibilities left
For the third character, you have 10 possibilities left
So you have a total of 62*32*10 possibilities WITH enforced complexity

Example B:
Let us assume you have no special policy regarding the complexity, but also a 
password length of 3. 
For the first character, you have 26+26+10 = 62 possibilities
For the second character, you have 26+26+10 = 62 possibilities
For the third character, you have 26+26+10 = 62 possibilities
So you have a total of 62*62*62 possibilities WITHOUT enforced complexity

Of course, a length of 3 chars is only for demonstration purposes here ;-)

Have fun

Frank Heyne