The general process is to determine the combinations of each sub-rule, and how the sub-rules interact. If they are statistically independent (ex. random dice rolls), then they are multiplied together in the entropy calculation.
Using the notation here
- L = Password Length; Number of symbols in the password
- S = Size of the pool of unique possible symbols (character set)
- Number of Possible Combinations = S^L
- Entropy = log2(Number of Possible Combinations)
1. Simple 8 character password
L = 8
A-z0-9, random sequence
A-Z = 1/26
a-z = 1/26
0-9 = 1/10
Each char is (26 + 26 + 10) = 62 = S
S^L = 62^8
Entropy = log2(62^8) = 47 bits
2. Passphrase chosen from hypothetical corpus of pop culture
- 5 word phrase chosen from corpus of 10,000,000 phrases
- First letter may be capitalized
The phrase length is irrelevant, what matters is the combinations.
For the phrase part:
The caps rule doubles the number of combinations.
Entropy = log2(10,000,000 * 2) = 24 bits
3. Diceware-style with additional "strength" rules
- 4 random words drawn from list of 7776 words (6^5, 6-sided die, 5 rolls)
- The first or last word in the sequence may start with a capital letter, but not both (0-1 capital letters in passphrase)
- The words are joined with space,
-, or no spacing character at all (ex. correcthorse)
- The sequence starts or ends with 1 of the 10 symbols on a US keyboard number row
- 3 words are S=7776=6^5
- 1 word is S = (7776 * 2), for caps and lower. And it can be the first or the last word, doubling the options.
- The joining multiplies the possibilities by 3 (
-NA, 3 options)
- The special characters multiply the possibilities by 10
S = (6^5)^3 * 2 * 2 * 6^5 * 3 * 10
Entropy = log2(S) = 58 bits
Note: The additional rules only multiplied S by 120 (2 * 2 * 3 * 10) vs. a simple 4 word diceware phrase.. This added ~7 bits of entropy. A simple 5 word phrase is more entropic than the rules above, multiplying S by 7776.
- Calculating password entropy? and Statistical metrics for individual password
- What is the best way to calculate true password entropy for human created passwords?
- How genuine are password entropy calculations?
- XKCD #936: Short complex password, or long dictionary passphrase?