Restrictions on carp passwords

Are there requirements and restrictions to be observed when defining CARP passwords? What about use of complete passphrases ... are there any other considerations then? I thought I saw an article about this some little time ago, but cannot find it now that I want it ... Sigh.