A computer system uses passwords constructed from the 26 letters (a–z) or 10 integers (0–9). Suppose that 10,000 users of the system have unique passwords. A hacker randomly selects (with replacement) passwords from the potential set.

(a) Suppose that 9900 users have unique six-character passwords and the hacker randomly selects six-character passwords. What are the mean and standard deviation of the number of attempts before the hacker selects a user password?

(b) Suppose that 100 users have unique three-character passwords and the hacker randomly selects three-character passwords.

What are the mean and standard deviation of the number of attempts before the hacker selects a user password?

(c) Comment on the security differences between six- and three-character passwords.