class

KemalIdentity::Passwords::LengthPolicy

Inherits KemalIdentity::Passwords::Policy < Reference < Object

The shipped policy: a length floor, the algorithm's ceiling, and a breach hook.

Two units, deliberately

The minimum is in characters and the maximum in bytes. They measure different things. The floor is about how much a person chose to type, and counting a two-byte character as two would punish a passphrase in Greek for being in Greek. The ceiling is the algorithm's hard limit, which is a byte count, and pretending otherwise is how a password gets silently truncated (blueprints/0004-hasher-over-length-behaviour.md).

Constants

DEFAULT_MIN_LENGTH = 12

docs/02-security-model.md: length is the requirement that actually correlates with strength, so it is the one that ships.

Constructors

for(hasher : Hasher, min_length : Int32 = DEFAULT_MIN_LENGTH, breach_check : BreachCheck = NullBreachCheck.new) : self

Builds a policy whose ceiling is the hasher's actual limit, rather than a number copied from a document and left to drift when the hasher changes.

Source

new(max_bytesize : Int32, min_length : Int32 = DEFAULT_MIN_LENGTH, breach_check : BreachCheck = NullBreachCheck.new)

Source

Instance methods

max_bytesize

Source

min_length

Source

violations(password : Secret) : Array(PolicyViolation)

Every reason this password is unacceptable. Empty means acceptable.

All of them, not the first one: telling somebody their password is too short, and then after they fix it that it is also breached, is a worse experience than saying both at once.

Source