[RESOLVED] Password Strength

Phpscrub

I am trying to check this array of passwords to see if they meet this criteria:
At-least 1 capital letter character
At-least 1 lower case letter character
At-least 1 numerical character
At-least 1 none alphanumerical
Must be 8 to 16 characters long

This code works. However, I want the if statement that contains the preg_match method to only contain 1 preg_match method and no strlen method.

<HTML>
	<Title>Password Strength</Title>
	<body>
		<h1>Password Strength</h1><hr />

	<?php
		$password = "Pass%word1";
		$passwordArray = array(
			"Pass\$word1",
			"!Passwor2d",
			"Passwo3\$rd",
			"4Password%",
			"Password",
			"Password1",
			"password2",
			"PASSWORD1",
			"P%wor1");

		foreach($passwordArray as $password)
		{
			if((preg_match("/[A-Z]/",$password) ==1)&& 
			(preg_match("/[a-z]/", $password) ==1)&&
			(preg_match("/[0-9]/", $password) ==1)&&
			(preg_match("/\W/", $password) == 1) &&
			((strlen("$password") >7) && (strlen("$password")<17))
			)



			echo "$password  is a valid password.</br>";
			else
			echo "$password  is an invalid password.</br>";
		}
		echo "done1";
		?>
		</body>
		</html>

bradgrafelman

Phpscrub;10997401 wrote:
I want the if statement that contains the preg_match method to only contain 1 preg_match method and no strlen method.

Why?

Phpscrub

bradgrafelman;10997402 wrote:
Why?

If I could see that all in one preg_match method it would help me gain a better understanding of the preg_match method.

bradgrafelman

There are much better ways of learning how to write regular expressions rather than coming up with an impratical demand with no justification that decreases readability.

Phpscrub

bradgrafelman;10997407 wrote:
There are much better ways of learning how to write regular expressions rather than coming up with an impratical demand with no justification that decreases readability.

I've read other sources and tried to piece it together myself. I'm asking for help on doing this for future references.

bradgrafelman

The point I'm trying to make is that in this situation, it's not only impractical to try and combine them into a single regular expression (I'm certainly not even going to try), but it's not even going to be helpful to do so.

NogDog

<?php

function isPasswordStrongEnough($password)
{
   $regexp = '#^.*(?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[^0-9a-zA-Z]).*$#';
   return preg_match($regexp, $password);
}

$testData = array(
   'Short1-',
   'allLetters',
   'nocaps123-.',
   'Valid-Password-1'
);

foreach($testData as $pwd)
{
   echo $pwd . ': ';
   echo (isPasswordStrongEnough($pwd)) ? 'Valid' : 'Invalid';
   echo "<br />\n";
}

bradgrafelman

D'oh - it's been so long since I've done any heavy lifting with regexp's that I forget about nifty things like positive lookahead. :o

However, I thank you for a perfect example; I would much rather manage this:

               if((preg_match("/[A-Z]/",$password) ==1)&& 
                (preg_match("/[a-z]/", $password) ==1)&& 
                (preg_match("/[0-9]/", $password) ==1)&& 
                (preg_match("/\W/", $password) == 1) && 
                ((strlen("$password") >7) && (strlen("$password")<17)) 
                )

because of how easy it is to read and understand the requirements quickly as compared to:

   $regexp = '#^.*(?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[^0-9a-zA-Z]).*$#';
   return preg_match($regexp, $password);

NogDog

If I were a bit more bored and a bit less tired, I'd do some metering to see if either is significantly faster. 🙂

laserlight

bradgrafelman wrote:
I would much rather manage this: (...) because of how easy it is to read and understand the requirements

I agree, though I guess we could still satisfy half of the original requirements:

if (preg_match('/[A-Z]/', $password) &&
    preg_match('/[a-z]/', $password) &&
    preg_match('/[0-9]/', $password) &&
    preg_match('/\W/', $password) &&
    preg_match('/^.{8,16}$/', $password))

By the way, Phpscrub, I recommend using single quoted string literal for regular expression patterns to avoid potential problems with backslashes in the pattern that are special to the regex syntax rather than PHP string syntax.

Derokorian

using these passwords:

$passwords = array( 
   'Pass\$word1', 
   '!Passwor2d', 
   'Passwo3\$rd', 
   '4Password%', 
   'Password', 
   'Password1', 
   'password2', 
   'PASSWORD1', 
   'P%wor1',
   'Short1-',
   'allLetters',
   'nocaps123-.',
   'Valid-Password-1',
);

With these function definitions:

function singleRegEx($password) {
   $regexp = '#^.*(?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[^0-9a-zA-Z]).*$#';
   if( preg_match($regexp, $password) ) {
      return TRUE;
   } else {
      return FALSE;
   }
}

function multiRegEx($password) {
   if( preg_match('/[A-Z]/',$password) == 1 && 
       preg_match('/[a-z]/', $password) == 1 && 
       preg_match('/[0-9]/', $password) == 1 && 
       preg_match('/\W/', $password) == 1 && 
       strlen("$password") > 7 &&
       strlen("$password") < 17 ) {
      return TRUE;
   } else {
      return FALSE;
   }
}

At 5000 iterations per function per password (130,00 total function calls) I got the following:

multiRegEx Results:
Min:	0.006914 msec
Max:	42.322874 msec
Avg:	0.051284 msec

singleRegEx Results:
Min:	0.006914 msec
Max:	44.261932 msec
Avg:	0.040759 msec

Weedpacket

Though I personally would prefer to retain the strlen for performance reasons (the length of the string is immediately available), and make it the first test:

if((strlen($password) > 7)
	&& preg_match('/[A-Z]/', $password)
	&& preg_match('/[a-z]/', $password)
	&& preg_match('/[0-9]/', $password)
	&& preg_match('/\W/', $password))

(I'm just not that keen on having a maximum length on passwords...)

But if you want an artificial regexp challenge, try this one.

[font=monospace]$n[/font] is a positive integer: [font=monospace]preg_match('/pattern/', "$n")[/font] returns 1 if $n is divisible by 7, and 0 otherwise. (For practice, start with other divisors, like 2, 4, and 3.)

Weedpacket

Derokorian wrote:

multiRegEx Results:
Min:	0.006914 msec
Max:	42.322874 msec
Avg:	0.051284 msec

singleRegEx Results:
Min:	0.006914 msec
Max:	44.261932 msec
Avg:	0.040759 msec

Could I see your test code? I tried to reproduce but my numbers don't remotely resemble those (I'm aggregating over five thousand runs, where each run is over all the passwords).

Derokorian

Borrowed from one of BG's posts a while back:

<?php

/************** 
* Test setup * 
**************/
set_time_limit(0);echo '<pre>';
$funcs = array('multiRegEx', 'singleRegEx'); 
$params = array( 
   array('Pass\$word1'), 
   array('!Passwor2d'), 
   array('Passwo3\$rd'), 
   array('4Password%'), 
   array('Password'), 
   array('Password1'), 
   array('password2'), 
   array('PASSWORD1'), 
   array('P%wor1'),
   array('Short1-'),
   array('allLetters'),
   array('nocaps123-.'),
   array('Valid-Password-1'),
);
$num_times = 25000; 
$unit_conv = array(1000, 'msec'); 
$precision = 6; 
$sound = true; 

/***************************************** 
* Definitions of functions to be tested * 
*****************************************/ 
function singleRegEx($password) {
   $regexp = '#^.*(?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[^0-9a-zA-Z]).*$#';
   if( preg_match($regexp, $password) ) {
      return TRUE;
   } else {
      return FALSE;
   }
}

function multiRegEx($password) {
   if( preg_match('/[A-Z]/',$password) == 1 && 
       preg_match('/[a-z]/', $password) == 1 && 
       preg_match('/[0-9]/', $password) == 1 && 
       preg_match('/\W/', $password) == 1 && 
       strlen("$password") > 7 &&
       strlen("$password") < 17 ) {
      return TRUE;
   } else {
      return FALSE;
   }
}



/*********************************** 
* !!! END OF EDITABLE REGIONS !!! * 
***********************************/ 



/******************************* 
* Init stat-keeping variables * 
*******************************/ 
$times = array_fill(0, count($funcs), array()); 
$medians = array_fill(0, count($params), array()); 

/************* 
* Run tests * 
*************/ 
for($func_idx = 0; $func_idx < count($funcs); $func_idx++) 
{ 
    $times[$func_idx] = array_fill(0, count($params), array()); 

for($param_idx = 0; $param_idx < count($params); $param_idx++) 
{ 
    for($i = 0; $i < $num_times; $i++) 
    { 
        $start = microtime(true); 
        call_user_func_array($funcs[$func_idx], $params[$param_idx]); 
        $end = microtime(true); 

        $times[$func_idx][$param_idx][] = ($end - $start) * $unit_conv[0]; 
    } 

    // Sort stored times 
    sort($times[$func_idx][$param_idx]) or die('error sorting times'); 

    // Store median value 
    $medians[$param_idx][$func_idx] = 
        $times[$func_idx][$param_idx][floor($num_times / 2)]; 
} 

// Announce completion of testing for function 
if($sound) 
    echo "\x07"; 
} 

/*********************************** 
* Generate output of test results * 
*      (grouped by function)      * 
***********************************/ 
echo "Number of executions: $num_times\n\n"; 

for($func_idx = 0; $func_idx < count($funcs); $func_idx++) 
{ 
    echo "Function #$func_idx :\n"; 

for($param_idx = 0; $param_idx < count($params); $param_idx++) 
{ 
    echo "\t$funcs[$func_idx](" . implode(',', $params[$param_idx]) . ")\n"; 

    // Variable rename for brevity 
    $p = $precision; 

    printf( 
        "\t\tMin: %.{$p}f %4\$s\n\t\tMax: %.{$p}f %4\$s\n" 
            . "\t\tAvg: %.{$p}f %4\$s\n", 
        $times[$func_idx][$param_idx][0], 
        $times[$func_idx][$param_idx][$num_times - 1], 
        (array_sum($times[$func_idx][$param_idx]) / $num_times), 
        $unit_conv[1] 
    ); 
} 
} 

echo "\n--------------------------------------------------\n\n"; 

/*********************************** 
* Generate output of test results * 
*     (grouped by parameters)     * 
*     (based on func medians)     * 
***********************************/ 
for($param_idx = 0; $param_idx < count($params); $param_idx++) 
{ 
    echo "Parameter Group #$param_idx (" . implode(',', $params[$param_idx]) 
        . ") :\n"; 
    echo "\tMedians :\n"; 

// Sort median values 
asort($medians[$param_idx]) or die('error sorting medians');; 

foreach($medians[$param_idx] as $func_idx => $median) 
{ 
    // Variable rename for brevity 
    $p = $precision; 

    printf( 
        "\t\t%s: %.{$p}f %s\n", 
        $funcs[$func_idx], 
        $median, 
        $unit_conv[1] 
    ); 
} 
}

Edit: Btw Getting almost the same results at 25000 and 50000 iterations with normal variance of each refresh.

laserlight

Weedpacket wrote:
(I'm just not that keen on having a maximum length on passwords...)

Aye, this is a good point. Since the passwords would likely be hashed prior to storage, the password length itself should not be a problem.

Bonesnap

I also agree on the maximum password length. Let the user decide for himself what is too long.

NogDog

The regexp I provided, anyway, is only checking for minimum pwd length.

Derokorian

@Weed when I run the tests on my public facing webserver instead of my local server (basic wamp, good for small script testing 😛) I get almost identical results for both functions where as locally the single regex is almost always slightly faster.

sneakyimp

Yes don't limit password length:
http://xkcd.com/936/