You are correct: quotes are needed. It works perfectly fine for me:

1* ALTER USER TT IDENTIFIED BY VALUES 'DF305179EE5BCFED'
urc01:RMAN> /

User altered.