I am teaching SW testing in a Computer Science department. As expected, I am conducting equivalence partitioning testing. For an exercise, I gave the class a set of 5 rules for code that grades password strength and asked them to list the equivalence classes for it. It's a simple set of rules; they are not that critical to my question - I am listing them here just so you see it's a rather simple set of rules:
- The password score (grade) can be between 0 and 10 (10 is a strong password)
- A password should be longer than 12 characters. The score is reduced by the distance from the actual length and 12.
- A password should include at least one upper case letter, one lower case letter, and one number. The score is reduced by 2 for every infraction.
- A password shouldn't be the words “password”, "admin" or "root". Violating this rule results in a score of 0.
- A password shouldn't be the same letter or number repeated for its entire length. This deducts 7 points.
The resulting number of equivalence classes is... 20. This is after I added some restrictions to avoid the number being even higher.
So my question: If for such simple code, I need 20 ECs, for an extensive system, the ECs will be an enormous number - rendering the EP test technique not very helpful.
Am I, and all the SW test textbooks, overplaying the usefulness of this technique? Is it useful except for trivial examples?