They are only information messages not errors - they don't need message IDs.

Also when actually validating the password all failures reasons should be identified and listed rather than just the first one encountered.

Overall the messages would be better if they were restructured rather than the one line per requirement approach we have now.