Strong Passwords and Keyspace
A guided-inquiry activity. Work in a team of 3 to 4, or on your own. Read each Model, then answer the Critical Thinking Questions in order before revealing a hint.
Learning objectives
- Compute the keyspace of a password as N to the power L.
- Explain why adding length beats adding character types.
- Explain how multi-factor authentication protects an account.
Prerequisites: exponents, and the idea of a password.
Team roles
Model 1: Counting possible passwords
| characters allowed (N) | length (L) | possible passwords (N to the power L) |
|---|---|---|
| 26 (lowercase) | 4 | 456,976 |
| 26 (lowercase) | 6 | 308,915,776 |
| 95 (all symbols) | 4 | 81,450,625 |
- Compare rows 1 and 2: changing only the length from 4 to 6 multiplied the total by about how much?
Check your thinking
About 676 times (26 times 26). Two more lowercase letters multiply the count by 26 each.
- Compare rows 1 and 3: keeping length 4 but allowing all 95 symbols. Which change produced a bigger jump, more length or more characters?
Check your thinking
Both help, but notice length is an exponent. Over realistic lengths, adding length grows the total far faster than enlarging the character set.
- Write the formula for the number of possible passwords and name each part.
Check your thinking
N to the power L, where N is how many characters are allowed and L is the length.
Model 2: Time to crack
| password | rough time to crack |
|---|---|
| cat123 | instant |
| P@ssw0rd | hours to days |
| kayak-piano-river-7 | thousands of years |
- Using Model 1, explain why kayak-piano-river-7 is so much harder to crack than P@ssw0rd.
Check your thinking
It is much longer, so its keyspace (N to the power L) is vastly larger, and a guessing attack must try far more combinations.
- Define keyspace in your own words.
Check your thinking
The total number of possible passwords an attacker would have to try.
Model 3: Multi-factor authentication
| factor | example |
|---|---|
| something you know | a password |
| something you have | a phone or key |
| something you are | a fingerprint |
- An attacker steals your password but you have MFA turned on. Why can they still not log in?
Check your thinking
They have only one factor (what you know). MFA also requires a second factor (what you have or are), which the attacker does not possess.
- Why is a long passphrase plus MFA stronger than a short complex password alone?
Check your thinking
The passphrase gives a huge keyspace, and MFA means a stolen or guessed password is still not enough by itself.
Do it now
Application
Write a one-sentence password rule for a school that uses Model 1 and Model 3 to justify itself.
Reflection (process skills)
Did everyone on the team get to explain a row? What is one way to share the talking more evenly next time?