A Conceptual Framework for Assessing Password Quality

Abstract

Password authentication is the most widely used authentication mechanism, and it will still be with us for many years yet to come. It is effective, simple, and accurate, with no extra cost. The strength of password authentication relies on the strength of the passwords. Good (or strong) passwords are essential for high level security. End user education and computerized proactive password checking play vital roles in ensuring good passwords. However, both demand clear, simple, and concise rules on what a good password is. It is not hard to find guidelines and advices on good passwords; but it is not so easy to find a clear, simple, and concise rule to be used for end user education and computer programs for proactive password checking. In this paper, we develop a theoretic framework on measuring password quality – password quality indicator (PQI). A PQI of a password is a pair) , (L D = λ , where D is the Levenshtein's edit distance of the password to the base dictionary words, and L is the effective password length. Based on PQI, we further simplify the rule for a good password to at least 8 characters long, with at least 3 special characters plus other alphanumeric characters.