Assume user must choose 8 character password using:

1. lowercase letters a-z (size=26)
2. uppercase letters A-Z (size=26)
3. digits 0-9 (size=10)
4. special characters/symbols (size=33)

policy 1) user can choose password freely

my answer: $95^8$ combinations, since 26+26+10+33 = 95.

policy 2) The password must at least have one digit or at least one special character.

my answer: number of passwords with at least one digit = $10^8$

number of passwords with at least one special character = $33^8$

number of passwords with at least one digit or at least one special character equals to $10^8$ + $33^8$

are my calculations correct or I am making some stupid mistake?

• $26^8 + 26^8 + 10^8 + 33^8 \ne 95^8$ – miracle173 Nov 16 '16 at 14:28
• @miracle173 - of course, I expressed my thoughts wrong on 'paper', corrected. – Leonardo Nov 16 '16 at 14:31
• @miracle173: $(26+26+10+33)^8=95^8$!!! – barak manos Nov 16 '16 at 14:39
• Could we reach the same answer by "constructing" a valid password for policy 2? That is, picking any "digit or special" (33+10), then placing it in a position in the password (8 possibilities), then picking all the other characters ($95^7$ possibilities)? – Riccardo Orlando Nov 16 '16 at 14:42

For your second part, number of valid passwords will be the total number possible minus the invalid ones.

Total number = $(26+26+10+33)^8 = 95^8$

Invalid ones are those which contain neither a digit nor special character. Thus available characters are only upper and lower case alphabets. Invalid = $(26+26)^8 = 52^8$

Thus acceptable passwords are: $95^8 - 52^8$

$10^8$ is the number of passwords composed of only digits, not the number with at least one digit. The number with at least one digit is $95^8-85^8$ as we subtract all those composed of non-digits. Can you extend this?

• yep, understood – Leonardo Nov 16 '16 at 14:40

You've made several mistakes:

Number of passwords with at least one digit is $10^8$.

No, it is $(26+26+10+33)^8-(26+26+33)^8$, or simply $95^8-85^8$.

Number of passwords with at least one special character is $33^8$.

No, it is $(26+26+10+33)^8-(26+26+10)^8$, or simply $95^8-62^8$.

Number of passwords with at least one digit or one special character is $10^8+33^8$.

No, it is $(26+26+10+33)^8-(26+26)^8$, or simply $95^8-52^8$.