If we use upper and lower case letters, and 10 digits, we get approximately 6 bits per character. Then, strings of 13 characters should work.

I saw above explanation in the material, but I cannot understand how 13 characters are appeared. How can I compute?


It's likely an error. The number of possible passwords of length $l$ from a character set size of $n$ is $n^l$. The number 13 probably came from a calculation for a character set with only one case. A set of $36^{12}$ passwords is smaller than a set of $2^{64}$. You need one additional character to get 64 bits of information.

$$36^{12} < 2^{64} < 36^{13}$$

A 13 character long password from a 62 element character set is equivalent to

$$\log_2(62^{13}) = 13 * \log_2(62) \approx 77.4 \ \text{(bits)}$$

The actual minimum number of characters for that character set is

$$\lceil\log_{62}(2^{64})\rceil = \lceil64 * \log_{62}(2)\rceil = 11 \ \text{(characters)}$$

And for that character set there are $\log_2{62} \approx 5.95$ bits of information per character. You can get the same number $11 = \lceil 64 / ~5.95 \rceil$.

A 13 character string* is sufficient to get a password with at least 64 bit strength. However that's satisfied by any number of characters no less than 11, making 13 characters unnecessarily long.

* Randomly selected from a uniform distribution


Suppose the number of a set $S$ is denoted as $Card(S)$ (which is sort for cardinality if you didn't know), then

$Card($uppercase-letters$)+Card($lowercase-letters$)+Card($digits$) =26+26+10=62$

To represent an element from a set of 62, you need a string of at least 6 bits, this is because $2^{6} = 64 \ge 62$

However I don't understand the title where it says "64 bits password = 13 characters" because $ 6 \cdot 13 = 78 $ which is way bigger here, than 64.

To achieve at least 64-bit entropy, you need to uniformly draw ${ {64} \over {log_2{62}} } \approx 11.00$ characters (10.749 to be more exact).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.