The password must be at least 1 character long. I've not been able to find a maximum length. I set the passphrase to be a 100,000 character string, and that worked fine. Missing the last character off the end of the long string didn't work, so the 100,000th character is significant.

When first setting a passphrase the satoshi client requests that your passphrase be at least 10 random characters or 8 random words. But it doesn't attempt to enforce its request.