The University of York have a similar length requirement. When I enquired about it, I was told it was because some of the older systems have a maximum length, and they keep your password the same everywhere.