Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I've been reading up a bit on deterministic password generators. All the ones I can find basically do something like this:

  1. Pick a master username and a master passphrase. The username could be your email, or a PIN, or something else. The master passphrase can be subject to stringent requirements to ensure sufficient entropy. The combination of these two factors needs to be ultra-secure and something you're reasonably certain that nobody's ever used before.

  2. Enter the site name that you want a password for.

  3. Generate the string $H^n\text{(passphrase||username||sitename})$, where $H^n(\cdots)$ is an n-fold iteration of SHA256 or some other sufficiently secure hashing algorithm and $||$ is string concatenation.

  4. Make sure that n is sufficiently large such that n iterations of the hash generates a substantial amount of work and protects against brute-forcing.

  5. Do a final deterministic mapping from this last string down to an n-character string where the individual chars of the string are in some set of "valid" characters (alphanumeric, alphanumeric+symbols, etc).

There are variations on the above, but that seems to be the basic idea.

Now, I'm curious how secure and trustworthy an algorithm like this really is compared to existing password managers.

For existing password managers, you have the same basic weakness - if your user+master pass is compromised, all of your passwords are also compromised. But does this system have any additional weakness on top of that?

It seems as though it'd be fairly resistant to the obvious things: - If your plaintext pass for one site is compromised, it'd be very difficult to work out your pass for another site.

  • Furthermore, due to the fact that the hash function is iterated a sufficient number of times, it'd be difficult to brute force.

  • The best way to attack this seems to be a rainbow table approach with a bunch of common master usernames, master passphrases, and site names, but so long as your username+passphrase is of sufficient entropy, that'd be difficult to pull off.

  • Furthermore, if you want extra security for a certain site, you can increase the entropy of the sitename field a bit (example: eBay becomes 3b4Y@!#$% or something).

Seems reasonably secure, but I don't know if I'm missing something. Is there some well-known weakness with this system?

share|improve this question
    
I have been developing something to kind of fix the issues you pointed out. No master username (master salt instead, more entropy), and it adds individual passwords for all sites. Site usernames are also involved in password calculation. It also uses a memory hard KDF with 20000 SHA256 loops. Rainbow tables are useless. This and the ones you described can also be used with existing managers, but are fine on their own unless there is an obvious flaw in the scheme. –  Richie Frame Nov 3 '13 at 7:26
add comment

1 Answer

The above scheme does have a very important drawback against schemes that encrypt a password store. If you randomly generate the site specific passwords then there is no relation to the master password. You would need the complete password store to perform e.g. dictionary attacks to find the master password. This is not true for the deterministic password generator you've described; one single leaked site specific password would enable an attacker to launch an attack on the master password. In the following two paragraphs I'll focus on the security without regard of this observation.

It seems that the scheme above is just an application of a Password Based Key Derivation Scheme (PBKDF), coupled with a deterministic method of mapping the result to a new password in step 5. As long as step 5 only maps to an array of characters in a specific alphabet without loosing entropy, the security of the scheme depends on the PBKDF used. KDF's commonly already include parameters specific to the secret that is to be generated (in this case that would be the site name).

So for the security of the scheme you should simply study security of PBKDF's and - if possible - the security of the specific PBKDF that is being used. Maybe you can compare the scheme against well known variants like PBKDF1, PBKDF2, bcrypt, scrypt or e.g. the proprietary OpenSSL PBKDF.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.