Re: Password length and complexity

[Steven Alexander <alexander.s () MCCD EDU>]

I've written a lot about passwords (including length, complexity, hashes and expiration) on my blog.  While blog posts 
don't count as "scholarly", mine do link to a number of academic papers and other resources.  I also work out a lot of 
the math.

http://bugcharmer.blogspot.com/search/label/Passwords

In particular:

How long should passwords be?
http://bugcharmer.blogspot.com/2012/06/how-long-should-passwords-be.html


For current research on measuring password entropy, check out Matt Weir's research:

http://reusablesec.blogspot.com/2010/10/new-paper-on-password-security-metrics.html
http://reusablesec.blogspot.com/2010/10/ccs-paper-part-2-password-entropy.html

These two blog posts comment on and explain Weir's paper which he presented at the 2010 ACM CCS conference.


Regards,

Steven Alexander Jr.
Online Education Systems Manager
Merced College
3600 M Street
Merced, CA 95348-2898
(209) 384-6191
alexander.s () mccd edu<mailto:alexander.s () mccd edu>

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Eric 
Weakland
Sent: Friday, May 31, 2013 10:08 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Password length and complexity

Greetings,

Do any of you have any links handy to scholarly/technical articles that have recommendations or strategies on choosing 
appropriate password length and complexity requirements?  We're working on extending out password expiration period 
significantly - let's say 1 year, and will be using things like 2-factor for extremely sensitive accounts, and I want 
to make sure we are using a sound rationale/reasons for the length we choose - backed up by some research.

Anyone know of useful studies/research results that could help guide our recommendations?

Best,


Eric Weakland, CISSP, CISM, CRISC
Director, Information Security
Office of Information Technology
American University
eric at american.edu
202.885.2241

______________________________________
AU IT will never ask for your password via e-mail.
Don't share your password with anyone!

This email has been scanned by a Spam/Virus Firewall. If your email has been classified as Spam please contact the 
HelpDesk at (209) 384-6180.