3

The PCI DSS requirement 8.2.3 says:

Passwords/passphrases must meet the following:

  • Require a minimum length of at least seven characters.
  • Contain both numeric and alphabetic characters.

Alternatively, the passwords/ passphrases must have complexity and strength at least equivalent to the parameters specified above.

I would like to define my policy that user should use passphrases instead of passwords with minimum length of 15 characters, without requiring both numeric and alphabetic characters in the passphrases.

Is this equivalent to what PCI DSS requires?

What is the metric of password/passphrase strength and how to compute it?

4

There's no guarantee that your QSA or other auditor will accept any answer offered here, but generally if you can justify your choices you can improve the odds that they will. So I'll provide the best argument that I can.

A 7 character password randomly generated from lowercase alphabetic, uppercase alphabetic, and numeric characters offers 62^7, or around 3,521,614,606,208, possible combinations. This also converts to around 42 bits of possibilities. I'm erring on the conservative side of saying alphabetic character case matters (e.g. uppercase and lowercase are different) even though the standard doesn't.

So what I would do in your situation is calculate the length needed to provide the equivalent number of possible random passwords when only using lowercase letters. That's 26^X ≥ 3.5 trillion, and X works out to be a minimum of 9 characters of length. If you go with your goal of a minimum length of 15 characters then you'll be at 70 bits of strength, which is a substantial improvement over the original 42 bits.

These numbers do assume we're talking about random passwords to offer this level of strength, which isn't typical of most environments. Most policies like this will still have users choosing passwords like "Muffins19" or passphrases like "Ilovemydogmuffins". It's harder to make a strength comparison between passwords and passphrases in this reality, so I'd suggest avoiding it. But you can, at the least, encourage good passphrase construction practices by providing users with a password manager or other software to generate random passphrases for them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.