Americas

  • United States

Asia

Oceania

roger_grimes
Columnist

Creating my Password Probability Math

Analysis
Feb 04, 20062 mins
Data and Information SecuritySecurity

Reader Dave Pullin wrote: Sir, Your math is a little off. Actually completely wrong. The number of passwords of length N from an alphabet of A characters is A to the power of N, (A^N) so the key space is A^1 + A^2 ... A^N it is not 1^A + 2^A ... n^A as you say in your article. By your equation a password of length 1 from the 62 letters and digit has only one possible value (it's obviously 62), whereas you say a

Reader Dave Pullin wrote:

Sir,

Your math is a little off. Actually completely wrong.

The number of passwords of length N from an alphabet of A characters is A to the power of N, (A^N) so the key space is A^1 + A^2 … A^N it is not 1^A + 2^A … n^A as you say in your article.

By your equation a password of length 1 from the 62 letters and digit has only one possible value (it’s obviously 62), whereas you say a password of length 2 would have 62+2^62, = 4 trillion trillion, combinations which would make a 2 character password fairly secure.

Dave

My reply:

Dave,

Thanks for writing. You are correct. Can I say that I was just checking to see if readers were paying attention? (grin)

My article says: “…in Windows, a log-on password can use almost any Unicode character, of which there are 65,536, and passwords can be as long as 127 characters. The effective keyspace, then, is 1^64,000 + 2^64,000+ … 127^64,000. “

And further, thanks for ignoring me and my editor’s error of converting my equations from 65,536 to 64,000.

On a related note, I had sent my math to multiple crypto experts for review, including Bruce Schneier, CTO of Counterpane and several books on crypto. He had sent back “corrected” math that didn’t’ work either, because he assumed that the password had to be =N length, which is a common assumption when dealing with fixed length cryptographic keys or hashes. Variable length passwords follow the math you stated above (and which I mistakenly reversed).

The math becomes harder to figure out if we say that a password must have a min. length, say N=14, but can be bigger up to N=127. Then the math becomes 65536^14+65536^15…65536^127.

Thanks for bringing this to my attention. It reminds me that crypto, like electricity, shouldn’t be a hobby.

Roger

roger_grimes
Columnist

Roger A. Grimes is a contributing editor. Roger holds more than 40 computer certifications and has authored ten books on computer security. He has been fighting malware and malicious hackers since 1987, beginning with disassembling early DOS viruses. He specializes in protecting host computers from hackers and malware, and consults to companies from the Fortune 100 to small businesses. A frequent industry speaker and educator, Roger currently works for KnowBe4 as the Data-Driven Defense Evangelist and is the author of Cryptography Apocalypse.

More from this author