Let me ask about my toy passwords generator program X5 which I want to improve. X5 uses a secret key and a public key to generate a password.Where any public key is supposed to be known to hackers in the worst case.
pwd = sK + pk
To describe details, let me define some expressions.
- each of K and k denotes a seed key but k corresponds to just one password generation, whereas you use K for all password generations;
K(n)means a seed key of n length;
pwd(n)means a password of n length;
sha1( s, n )returns the first n characters of sha1(s), where sha1 means recursively applying sha1 algorithm on the input string for a constant many many times.
Using the new expressions, my algorithm can be written as follows.
pwd(n) = sha1( sha1( sK(5) + pK(3 or longer) , 5 ) , n);
I want to X5 prepares for the following context of a user .
- The algorithm of X5 is in public.
- HackerA knows just one generated password pwd_X ;
- HackerA knows all public keys, of past and of future .
- HackerA even knows that pK_X was used to generate pwd_X.
- HackerA tests all possible patterns to know sK.
- HackerA knows all pairs of account names and servers.
- HackerA tests all passwords possibly generated by X5 against all servers.
Let me ask , if the following algorithm differs much than the previous one.
pwd(n) = sha1( sha1( sK(5) + sha1( pK(3 or longer) ,3 ) , 5 ) , n);
And which one is more secure?
Thank you in advance.