Is a longer password always safer?

Length matters most, yet repeated strings and common words still fall to dictionary attacks, so avoid both.

Must a salt be kept secret?

No; it only needs to be unique and random, and publishing it does not weaken the defence against rainbow tables.

S6 ICT | Network Security and Encryption Practice Paper 1 (Passwords and Symmetric Encryption)

2026-11-04

From 26 to the power 8 up to the cracking years of a 12-character password, separate keyspace, dictionary attacks and salting, then test the core limit of symmetric encryption.

Attempt first, mark afterwards　Allow about thirty minutes; write the exponent expression for each item before checking it on a calculator.

01　Paper details (check answers afterwards)

Item	Detail
Questions	10 items
Suggested time	About 30 minutes
Difficulty mix	Foundation 4 · Intermediate 3 · Challenge 2 · Error redo 1
Chapter	Chapter: S6 ICT \| Network Security and Encryption
Level	S6 (Secondary 6) ICT

02　Questions (10 items)

FoundationA password uses exactly 8 lowercase English letters. How many possible combinations are there?
FoundationContinuing from the previous item, an attacker tries 1 000 000 passwords per second and on average needs half the keyspace. Roughly how many hours is that?
FoundationWhat is the main limitation of symmetric encryption?
FoundationAn AES-256 key is 256 bits long. How many bytes is that?
IntermediateIf the password may use 26 lowercase letters plus 10 digits (36 characters) for the same 8 positions, how many times more combinations are there than letters only?
IntermediateWhy does a dictionary attack usually succeed faster than pure brute force?
IntermediateIn two-factor authentication (2FA), what are the two factors?
ChallengeWhen a site adds a salt before hashing stored passwords, which attack does that mainly defeat?
ChallengeGoing from 8 to 12 lowercase letters, how many times larger is the keyspace, and roughly how many years would cracking take on the same machine at 1 000 000 tries per second?
Error redoError drill: a student says Base64 encoding counts as encryption because the original text can no longer be read. What is wrong?

03　Answers and one-line notes

#	Answer	One-line note
1	208,827,064,576	Each position has 26 choices, so 8 positions give 26 to the power 8, which is 208,827,064,576; length is an exponent, not a multiple of 8.
2	About 29.0 hours	208,827,064,576 / 2 / 1,000,000 / 3 600 = 29.0 hours; only half the keyspace is needed on average, hence the division by 2.
3	Both sides must hold the same key, so the key itself has to be delivered securely first	One key both encrypts and decrypts, which is fast, but key distribution becomes the security problem.
4	32 bytes	256 / 8 = 32; converting bits to bytes always divides by 8.
5	About 13.51 times (2,821,109,907,456 combinations)	(36 / 26) to the power 8 = 13.51: a 1.38-fold larger alphabet becomes a 13.51-fold larger keyspace.
6	It tries the most common passwords first, so the hit rate is high without scanning the whole keyspace	A dictionary attack exploits human habits such as birthdays, 123456 or qwerty, so real accounts often fall within a few million attempts.
7	Something you know (a password) plus something you hold (a phone or a one-time code from a token)	Factors are categories, not counts: two passwords stay in one category, while crossing categories (know plus hold, or biometrics) is what makes 2FA.
8	Rainbow tables, i.e. precomputed hash lookup tables	A salt makes the same password hash differently in different accounts, so precomputation is wasted; a salt does not stop online guessing.
9	About 456,976 times (26 to the power 4); about 1,512 years	26 to the power (12 – 8) = 456,976; 95,428,956,661,682,176 / 2 / 1,000,000 / 3 600 / 8 766 is about 1,512 years, so four extra characters buy millions of times more work.
10	Base64 is only an encoding: anyone can reverse it with the same algorithm, and no key is involved	Encoding changes the representation for transport, while encryption uses a key for secrecy; unreadable output does not mean encrypted.

04　What to do after marking

After marking, redo only the wrong items and write down which step went wrong (formula, unit, or misread number).
Repeat the same item two days later; move to the next paper only when both attempts are correct.
Parents only need the answer and note columns; there is no need to explain every item.

Need a tutor for this chapter? Register here Tutor Registration →

Questions and answers are written originally by the TutorZone team and are not taken from any school, publisher or examination authority paper. Every value is checked by computer.