# Cryptography question - Number of passwords

Was just wondering whether anybody could help me with the following question:

A system accepts only passwords that contain:

• between 6 and 8 symbols: digit (0-9) or letter (a-z,A-Z);

• at least 2 letters and 2 digits; How many passwords are accepted by this system?

My solution would be to do the following:

If there are 6 symbols then we can have:

$\ \ \$• 2 letters 4 digits – (2+4)!/2!4!=15. 15 configurations x(52^2 x 10^4) possibilities

$\ \ \$• 3 letters 3 digits – (3+3)!/3!3!=20. 20 configurations x(52^3 X 10^3)possibilities

$\ \ \$• 4 letters 2 digits – (4+2)!/4!2!=15. 15 configurations x(52^4 X 10^2) possibilities

If there are 7 symbols we can have:

$\ \ \$• 2 letters 5 digits – 7!/2!5! = 21. 21 configurations x (52^2x 10^5) possibilities

$\ \ \$• 3 letters 4 digits – 7!/3!4! = 35. 35 configurations x (52^3x10^4) possibilities

$\ \ \$• 4 letters 3 digits – 7!/4!3! = 35 35 configurations x (52^4x10^3) possibilities

$\ \ \$• 5 letters 2 digits – 7!/5!2! = 21 21 configurations x (52^5x10^2) possibilities

If there are 8 symbols we can have:

$\ \ \$• 2 letters 6 digits – 8!/2!6!= 28. 28 configurations x(52^2 x 10^6) possibilities

$\ \ \$• 3 letters 5 digits – 8!/3!5!=56. 56 configurations x(52^3x10^5) possibilities

$\ \ \$• 4 letters 4 digits – 8!/4!4!=70. 70 configurations x(52^4x 10^4) possibilities

$\ \ \$• 5 letters 3 digits - 8!/5!3!=56. 56 configurations x(52^5x10^3) possibilities

$\ \ \$• 6 letters 2 digits – 8!/6!2!=28. 28 configurations x(52^6 x10^2) possibilities.

The answer I obtained was the addition of all of these values.

Can anyone help?

-
I did not check the arithmetic, but the basic reasoning is sound. I am assuming that, e.g., when you write 8!/6!2!, you mean 8!/(6!2!) – David Mitra Jan 6 '12 at 20:05
I forgot to mention: you seem to have done a fine job, no help needed. Unless someone more clever than I sees a quicker way to solve this. – David Mitra Jan 6 '12 at 20:32
Thanks! I think there is a more efficient way, such as working out the total number of passwords obtainable with (52+10) 62 possibilities for every character and then taking away the passwords with 1 letter 7 digits, 7 letter 1 digits, and 8 digits and 8 letters. But I'm not sure whether this makes logical sense.. – DMartinez Jan 6 '12 at 20:57
Of course, just because there are about $2^{46}$ passwords satisfying these criteria does not mean that a typical password chosen to fit the criteria has 46 bits of entropy. Indeed, depending on your user base, a very typical password chosen to fit these criteria might be abc123, which probably has less than 4 bits of effective strength (i.e. it's one of the first 16 passwords an attacker is likely to try). – Ilmari Karonen Jan 7 '12 at 0:46
On a lighter note: I so agree with Randall Munroe. – Jyrki Lahtonen Jan 7 '12 at 8:03

The alternative, which you gave in your comments, would be to work out $62^6+62^7+62^8$ which is 221,918,520,426,688 (about 1.6% more than $62^8$) and subtract the eight cases failing to meet "at least 2 letters and 2 digits" worked out the same way you already have, amounting to 138,164,728,164,288 exceptions and leaving 83,753,792,262,400 allowed cases.
I would just say it is on the order of $62^8$.
It is about 38% of $62^8$. – Henry Jan 6 '12 at 23:36