In a recent exercise on cyber security, there was this task to determine the number of valid passwords, given a set of password rules. On of the rules was as follows:

Task Small Characters (n=26) Capital Characters (n=26) Digits (n=10) Special Characters (n=35) Min Length Max Length
A ≥ 1 ≥ 1 6 8
B 1 1 6 8

For task B, my solution (according to the tutor) was correct:

$$\sum_{k=6}^{8}(52^{k-2}\cdot k \cdot (k-1) \cdot 10 \cdot 35)$$

It simply takes into account that one of the $$[6,7,8]$$ password symbols is a digit, one is a special char, and the others must be small or capital letters.

For Task A, I thought the solution would be similar, such that

$$\sum_{k=6}^{8}(97^{k-2}\cdot k \cdot (k-1) \cdot 10 \cdot 35)$$

This time, the only difference is that the other symbols are not restricted to small and capital chars, but could be anything else as well. However, I was told that this is incorrect, and instead, one has to compute the number of valid passwords as the number of all possible passwords, and subtract the number of invalid ones, namely those with only small or capital chars, only one digit, or only one special character. This also sounds reasonable, but the result is different from the one I had. Can anybody tell me what is wrong with the above formulation?

Your method counts passwords with more than one special character or more than one digit multiple times, once for each way you could designate a special character as the special character and once for each way you could designate a digit as the digit in the password. For instance, your method would count the password $$123!*\&$$ nine times.

$$\color{blue}{1}23\color{red}{!}*\&$$

$$\color{blue}{1}23!\color{red}{*}\&$$

$$\color{blue}{1}23!*\color{red}{\&}$$

$$1\color{blue}{2}3\color{red}{!}*\&$$

$$1\color{blue}{2}3!\color{red}{*}\&$$

$$1\color{blue}{2}3!*\color{red}{\&}$$

$$12\color{blue}{3}\color{red}{!}*\&$$

$$12\color{blue}{3}!\color{red}{*}\&$$

$$12\color{blue}{3}!*\color{red}{\&}$$