Chapter 12 — Probability and statistics

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Guessing space in bits"]
  N2["Lab — Password policy bits"]
  N3["12.2 Reading the table"]
  N4["12.3 Human choices and policy"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Guessing space in bits"]
  N2["Lab — Password policy bits"]
  N3["12.2 Reading the table"]
  N4["12.3 Human choices and policy"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Guessing space in bits]
    |
    v
[Lab — Password policy bits]
    |
    v
[12.2 Reading the table]
    |
    v
[12.3 Human choices and policy]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) measure password strength in bits; (2) compare policies by guessing space; (3) recognise why human choices reduce real strength.

12.1 Guessing space in bits

Strength against guessing is measured by the number of equally likely possibilities, expressed in bits as the base-2 logarithm. A secret chosen uniformly from N possibilities has log2(N) bits. Each extra bit doubles the attacker's work. Priya computes this for password policies Tidewell is considering. The calculation assumes that every possibility is equally likely, which holds for machine-generated secrets but rarely for human choices. She keeps that assumption visible in every table she produces. She also explains bits to staff using coin tosses.

Lab — Password policy bits

"""Guessing space for password policies, in bits (synthetic policies, uniform choice assumed)."""
import math
POLICIES = [("8 lowercase letters", 26, 8), ("8 mixed + digits", 62, 8),
            ("4 words from 7776-word list", 7776, 4), ("6 words from 7776-word list", 7776, 6)]

def main():
    for name, alpha, n in POLICIES:
        print(f"{name:<30} {n * math.log2(alpha):5.1f} bits")
    print("human-chosen passwords fall far below these uniform figures")

if __name__ == "__main__":
    main()

Run with python3 lab_entropy.py. Verified output:

8 lowercase letters             37.6 bits
8 mixed + digits                47.6 bits
4 words from 7776-word list     51.7 bits
6 words from 7776-word list     77.5 bits
human-chosen passwords fall far below these uniform figures

12.2 Reading the table

Eight random lowercase letters give 37.6 bits; eight random characters from letters and digits give 47.6. Four words chosen randomly from a 7,776-word list give 51.7 bits, and six words give 77.5. A randomly generated passphrase therefore beats a complex-looking eight-character password and is easier to remember. Priya stresses the word "randomly": a phrase chosen by a person, such as a favourite book title, has far fewer effective bits because attackers try common phrases first. The lab's last line states this limit. Grace asks for the table in the staff newsletter.

12.3 Human choices and policy

Real password studies show that people choose predictable patterns: capitalised first letters, years and exclamation marks. Composition rules often make passwords harder to remember without making them much harder to guess. Priya recommends that Tidewell allow long passphrases, check new passwords against lists of commonly used and breached passwords, rate-limit login attempts and offer a passphrase generator. She frames the recommendation as reducing guessability rather than satisfying rules, and notes that slow password hashing from Chapter 9 adds further protection. Grace takes the plan to the board.

Worked example

Priya shows that six random words give 77.5 bits against 47.6 for eight mixed characters, and recommends long passphrases, breached-password checks and rate limiting.

Synthetic case. The policies are invented; the calculations are standard.

Errors and limits

Bit calculations apply only to uniformly random choices. Rate limiting protects online guessing, not offline attacks on stolen hashes.

Exercises

• EX034 — Bits formula. How many bits does a uniformly chosen secret from N possibilities have?
  Show marking criteria

  Rubric: 3 = log2(N);; 2 = logarithm;; 1 = N;; 0 = none.
• EX035 — Passphrase result. Compare four random words and eight mixed characters from the lab.
  Show marking criteria

  Rubric: 3 = 51.7 bits versus 47.6 bits;; 2 = numbers;; 1 = reversed;; 0 = none.
• EX036 — Human phrases. Why does a person's chosen phrase have fewer effective bits?
  Show marking criteria

  Rubric: 3 = attackers try common phrases first; choices are not uniform;; 2 = predictable;; 1 = same;; 0 = none.

Synthesis

Measuring guessing space in bits shows why random passphrases outperform complex short passwords, provided choices are truly random.

Continue studying — chapter 12 of 40

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →