A company requires passwords to be at least 8 characters long and to contain only uppercase letters (26), lowercase letters (26), digits (10) and special symbols (10). An attacker can try 1,000 passwords per second.

(a) Assuming a user chooses a password uniformly at random from all possible 8‑character passwords that meet the policy, compute the expected time (in years) for the attacker to crack the password by brute force.
(b) The security policy states that the average cracking time must be at least one year. Does the current policy satisfy this requirement?

Question

A company requires passwords to be at least 8 characters long and to contain only uppercase letters (26), lowercase letters (26), digits (10) and special symbols (10). An attacker can try 1,000 passwords per second.

(a) Assuming a user chooses a password uniformly at random from all possible 8‑character passwords that meet the policy, compute the expected time (in years) for the attacker to crack the password by brute force.
(b) The security policy states that the average cracking time must be at least one year. Does the current policy satisfy this requirement?

Accepted Answer

Expected time ≈ 11,450 years; policy satisfies the one‑year requirement.

Neco 2021 Data Processing Question 48

Answer Options

About This Question

Master the Exam!