SECURING


The password quality scale

When creating passwords for user, server, or certifier IDs, you need to understand the criteria by which Domino® measures password strength and security. Domino measures this criteria according to the level assigned on its password quality scale. The scale assigns a minimum level of quality to the password on an ID file. Domino bases the password quality on the number and variety of characters in the password.

The algorithm used to calculate password quality is used to enforce the selection of passwords that are sufficiently complex to meet the password quality scale level chosen to protect user ID files. When a user is registered, the user's ID file contains a password strength value. This setting is enforced if the user changes the password.

The scale ranges from 0 (weakest -- no password required) to 16 (strongest). A quality of 1 indicates that any password satisfies the criteria. Domino defines default levels for certifier, server, and user password quality. You should change these defaults to meet your organization's security criteria. You can set the defaults in a security settings policy document, in Administration Preferences, or in the registration or certification dialog boxes.

Password strength is not the same as password length. Not all passwords of equal length have equal strength in the password quality scale. For example, the 8-character word "password" (because it is a word) and the 8-character word "1168Acme" (because it contains numbers and alphabetic characters) do not carry the same level of character complexity and do not have equal strength on the quality scale.

Table 1. Password quality scale descriptions
Password quality scale Description Example
0<nozeros>Password is optional.None.
1<nozeros>Allow any password.b, 3
2-6Allow a weak password, even though you might be able to guess it by trial and error.password, doughnut (password quality scale 3)

lightferret, b 4D (password quality scale 6)

7-12Require a password that is difficult to guess, but might be vulnerable to an automated attack.pqlrtmxr, wefourkings (password quality scale 8 )
13-16Require a strong password, even though the user may have difficulty remembering it.4891spyONu (password quality scale 13)

lakestreampondriverocean, stRem2pO() (password quality scale 15)

stream8pond1river7lake2ocean (password quality scale 16)


Tips for assigning passwords and scale


Related concepts
Password-protection for Notes and Domino IDs

Related information
IBM developerWorks Technical Library