# What are the pros and cons of deterministic site-specific password generation from a master pass?

I've been reading up a bit on deterministic password generators. All the ones I can find basically do something like this:

1. Pick a master username and a master passphrase. The username could be your email, or a PIN, or something else. The master passphrase can be subject to stringent requirements to ensure sufficient entropy. The combination of these two factors needs to be ultra-secure and something you're reasonably certain that nobody's ever used before.

2. Enter the site name that you want a password for.

3. Generate the string $H^n\text{(passphrase||username||sitename})$, where $H^n(\cdots)$ is an n-fold iteration of SHA256 or some other sufficiently secure hashing algorithm and $||$ is string concatenation.

4. Make sure that n is sufficiently large such that n iterations of the hash generates a substantial amount of work and protects against brute-forcing.

5. Do a final deterministic mapping from this last string down to an n-character string where the individual chars of the string are in some set of "valid" characters (alphanumeric, alphanumeric+symbols, etc).

There are variations on the above, but that seems to be the basic idea.

Now, I'm curious how secure and trustworthy an algorithm like this really is compared to existing password managers.

For existing password managers, you have the same basic weakness - if your user+master pass is compromised, all of your passwords are also compromised. But does this system have any additional weakness on top of that?

It seems as though it'd be fairly resistant to the obvious things: - If your plaintext pass for one site is compromised, it'd be very difficult to work out your pass for another site.

• Furthermore, due to the fact that the hash function is iterated a sufficient number of times, it'd be difficult to brute force.

• The best way to attack this seems to be a rainbow table approach with a bunch of common master usernames, master passphrases, and site names, but so long as your username+passphrase is of sufficient entropy, that'd be difficult to pull off.

• Furthermore, if you want extra security for a certain site, you can increase the entropy of the sitename field a bit (example: eBay becomes 3b4Y@!#\$% or something).

Seems reasonably secure, but I don't know if I'm missing something. Is there some well-known weakness with this system?

-
I have been developing something to kind of fix the issues you pointed out. No master username (master salt instead, more entropy), and it adds individual passwords for all sites. Site usernames are also involved in password calculation. It also uses a memory hard KDF with 20000 SHA256 loops. Rainbow tables are useless. This and the ones you described can also be used with existing managers, but are fine on their own unless there is an obvious flaw in the scheme. –  Richie Frame Nov 3 '13 at 7:26