The problem with this analysis is that complexity cannot be guaranteed, and for the most part will be circumvented by your end-users. Whether you give them 94 characters or 65,000 characters to choose from, most will choose to include the same 32 characters (several studies have discussed this, including this Microsoft debate).
This means that the effective password space for most environments is 32^L, plus a few more characters. In the study cited above, 10 percent of the cracked passwords only used the included 32 characters. It's important to note that this was a sample of passwords within a company that had a higher state of security than most organizations.
And because most users also use dictionary words as the root to their “complex” password, and follow other common conventions (capitalized letters are at the beginning, numbers are at the end), a simple hybrid attack will break most of them in less than a day. Trust me, I know -- I do it for a living.
There is no easy way to force true password complexity in most environments without a software addition, other than to generate truly random passwords and hand them out to users. They will probably hate you for doing so, but the greater concern is that writing down their passwords makes them even weaker than noncomplex passwords.
If you can’t guarantee true password complexity (and you probably can’t) length is your best bet. I’d guess that a typical good, knowledgeable password hacker can crack up to nine-character passwords within normal levels of ability and resources. At 10 characters, it becomes very hard to crack, regardless of complexity.
So, when trying to increase the strength of your passwords, my advice is to consider length as much or more than you consider complexity. For my money, length is all the protection I need. Make your admin and root passwords 15 or more characters long and forget about complexity -- at 15 characters-plus, they are all but uncrackable.
If you still don’t believe me, participate in my password cracking challenge. Win $100 and books. Odds are that you’ll crack the 10-character complex challenge long before the 15-character no-complexity password.
