Computer security experts always advise that personal information such as names, dates of birth, phone numbers, vehicle plate numbers and etc. should not be used as a part of our passwords. However, to make their passwords easier to be recalled, this advice is still neglected by many people. Personal information is still the first idea in the mind of many people when they are asked for a new password. Hence, weak passwords that are easily cracked by attackers using targeted dictionary attack are chosen. In this question, you are going to compute the number of different possible passwords if your personal information is used for such purpose. This computation can be carried out by first identifying a set which representing your password space described below. Assume that for a man with the following personal information: Name : John Doe Date of birth : 12 Oct 1987 Address : 34, Jalan Melintang, Taman Menegak, Puchong, Selangor Car plate number : PAR560 Favorite colour : blue With this personal information, assume that the man only choose Name, Date of birth" and "Car plate number" to form the password space. This password space is a set P that contains all the basic elements that can be selected to form a password. P = { johndoe, John, john, jd, 12, twelve, Oct, 10, 1987, 87, par, 560, Par560, pAr560, ...} Since choosing a password is a subjective process, everyone is free to determine which personal information should be included into the password space. In addition, once a piece of information is chosen, password creators also have the freedom to select its variants to form the set P. For example, John Doe only choose "Name", Date of birth" and "Car plate number but not "Address and Favorite colour. Furthermore, once "Name" is chosen, the variants "johndoe, JohnDoe", "john" and "jd" are selected to form the set P, but "doe", "JOHNDOE" and some other variants are not included. With this password space, there are many patterns of password formation. Among all, two common patterns are listed as follow: Pattern 1 : Use any 2 pieces of information to form passwords. Examples: john560, JOHN560, johnjd, 1987Par 560, 1987par. Pattern 2 : Use full or part of the name and mix with another 2 pieces of information. Examples: 12johndoe 1987, 12JOHNDOE1987, JD1987PAR. Since "easier to recall" is the reason of using personal information to form passwords, permutations in a basic element is NOT considered as one of the pattern because it is too random. For example : "johndoe12" match Pattern 1 above, however 1jodohne2 which formed with the same numbers and alphabets is not accepted. Now, assume that there is no limit on the length of a password, answer the following questions using YOUR OWN PERSONAL INFORMATION. a) List at least 4 of your own personal information, followed by its variants which you may use to form passwords. With this information, form a set that represent the complete password space, P. Identify n(P) and then determine the number of different passwords that can be formed with Pattern 1. b) How many different passwords can be formed with Pattern 2? c) Besides Pattern 1 and 2, suggest one password formation pattern based on set P. Discuss how this pattern offers a higher number of different passwords compared to Pattern 1 and 2. d) Computer security experts suggest that a strong password can be formed by randomly choosing characters from all the alphabets, numbers and 30 symbols listed below: '~!@#$%^&* ( ) - =+_][{}';:"/.,? If the advice is followed, about 5.132188731x1015 different passwords can be formed. Explain how this number is obtained. Then, considering that the length of the password of some systems cannot exceed 16 characters, explain why the number of different passwords formed by personal information hardly reaches this number
