Return to Question

I would like to prompt users for a single passphrase to establish trust with separate, normally (but not always) complementary systems from one password input.

I'm essentially looking for a box where one password enters and two leave, where maximum of entropy is maintained and the ability of an attacker using either output password to derive the other is minimized.

There are some constraints:

• The algorithm must be public knowledge.
• No other secret keys can be involved.
• Output passwords must be deterministic for any given input password.

A simple answer seems to be:

• $\rm pass1 = HMAC(password, \text{ "Magic One"})$
• $\rm pass2 = HMAC(password, \text{ "Magic Two"})$

With this method, it should be as difficult for someone who knows $\rm pass1$ to derive $\rm pass2$ as it would be for them to guess $\rm password$.

Are there better existing algorithms? The only reference I have been able to find is Steve Bellovin's Hashed Password Exchange Internet-Draft using the same basic method.

Specifically, is it practically possible to increase the difficulty of someone with knowledge of $\rm pass1$ to derive $\rm pass2$ to be more than the difficulty of guessing $\rm password$ itself, even if it requires spending portions of available $\rm password$ entropy?

For example, let's assume that $\rm pass2$ is exposed in an environment where it is being attacked "offline", while $\rm pass1$ is less vulnerable. In this case, $\rm pass1$ is effectively also exposed to the "offline" risk as much as $\rm pass2$.

I would like to prompt users for a single passphrase to establish trust with separate, normally (but not always) complementary systems from one password input.

I'm essentially looking for a box where one password enters and two leave, where maximum of entropy is maintained and the ability of an attacker using either output password to derive the other is minimized.

There are some constraints:

• The algorithm must be public knowledge.
• No other secret keys can be involved.
• Output passwords must be deterministic for any given input password.

A simple answer seems to be:

• $\rm pass1 = HMAC(password, \text{ "Magic One"})$
• $\rm pass2 = HMAC(password, \text{ "Magic Two"})$

With this method, it should be as difficult for someone who knows $\rm pass1$ to derive $\rm pass2$ as it would be for them to guess $\rm password$.

Are there better existing algorithms? The only reference I have been able to find is Steve Bellovin's Hashed Password Exchange Internet-Draft using the same basic method.

Specifically, is it practically possible to increase the difficulty of someone with knowledge of $\rm pass1$ to derive $\rm pass2$ to be more than the difficulty of guessing $\rm password$ itself, even if it requires spending portions of available $\rm password$ entropy?

For example, let's assume that $\rm pass2$ is exposed in an environment where it is being attacked "offline", while $\rm pass1$ is less vulnerable. In this case, $\rm pass1$ is effectively also exposed to the "offline" risk as much as $\rm pass2$.

I would like to prompt users for a single passphrase to establish trust with separate normally but not always complimentary systems from one password input.

I'm essentially looking for a box where one password enters and two leaves where maximum of entropy is maintained and the chance of using either output password to derive the other is minimized.

There are some constraints: The algorithm must be public knowledge. No other secret keys can be involved. Output passwords must be deterministic for any given input password.

A simple answer seems to be:

pass1 = HMAC(password,"Magic One") pass2 = HMAC(password,"Magic Two")

With this the difficulty of that which knows 'pass1' to derive 'pass2' should be the same as difficulty required to guess 'password'.

Are there better existing algorithms? The only reference I have been able to find is Steve Bellovin's draft-bellovin-hpw-01 using same basic method.

Specifically is it practically possible to increase the difficulty of someone with knowledge of 'pass1' to derive 'pass2' to more than the difficulty of guessing 'password' itself even if it requires spending portions of available 'password' entropy?

For example 'pass2' is exposed in an environment where it is being attacked "offline" while 'pass1' is less vulnerable. In this case 'pass1' is effectively also exposed to the "offline" risk as much as 'pass2'.

I would like to prompt users for a single passphrase to establish trust with separate, normally (but not always) complementary systems from one password input.

I'm essentially looking for a box where one password enters and two leave, where maximum of entropy is maintained and the ability of an attacker using either output password to derive the other is minimized.

There are some constraints:

• The algorithm must be public knowledge.
• No other secret keys can be involved.
• Output passwords must be deterministic for any given input password.

A simple answer seems to be:

• $\rm pass1 = HMAC(password, \text{ "Magic One"})$
• $\rm pass2 = HMAC(password, \text{ "Magic Two"})$

With this method, it should be as difficult for someone who knows $\rm pass1$ to derive $\rm pass2$ as it would be for them to guess $\rm password$.

Are there better existing algorithms? The only reference I have been able to find is Steve Bellovin's Hashed Password Exchange Internet-Draft using the same basic method.

Specifically, is it practically possible to increase the difficulty of someone with knowledge of $\rm pass1$ to derive $\rm pass2$ to be more than the difficulty of guessing $\rm password$ itself, even if it requires spending portions of available $\rm password$ entropy?

For example, let's assume that $\rm pass2$ is exposed in an environment where it is being attacked "offline", while $\rm pass1$ is less vulnerable. In this case, $\rm pass1$ is effectively also exposed to the "offline" risk as much as $\rm pass2$.

Would like to prompt users for a single passphrase to establish trust with separate normally but not always complimentary systems from one password input.

Essentially looking for a box where one password enters and two leaves where maximum of entropy is maintained and chance of using either output password to derive the other is minimized.

There are some constraints: Algorithm must be public knowledge. No other secret keys can be involved. Output passwords must be deterministic for any given input password.

Simple answer seems to be:

pass1 = HMAC(password,"Magic One") pass2 = HMAC(password,"Magic Two")

With this difficulty of that which knows 'pass1' to derive 'pass2' should be the same as difficulty required to guess 'password'.

Are there better existing algorithms? Only reference I have been able to find is Steve Bellovin's draft-bellovin-hpw-01 using same basic method.

Specifically is it practically possible to increase difficulty of someone with knowledge of 'pass1' to derive 'pass2' to more than difficulty of guessing 'password' itself even if it requires spending portions of available 'password' entropy?

For example 'pass2' is exposed in an environment where it is being attacked "offline" while 'pass1' is less vulnerable. In this case 'pass1' is effectively also exposed to the "offline" risk as much as 'pass2'.

I would like to prompt users for a single passphrase to establish trust with separate normally but not always complimentary systems from one password input.

I'm essentially looking for a box where one password enters and two leaves where maximum of entropy is maintained and the chance of using either output password to derive the other is minimized.

There are some constraints: The algorithm must be public knowledge. No other secret keys can be involved. Output passwords must be deterministic for any given input password.

A simple answer seems to be:

pass1 = HMAC(password,"Magic One") pass2 = HMAC(password,"Magic Two")

With this the difficulty of that which knows 'pass1' to derive 'pass2' should be the same as difficulty required to guess 'password'.

Are there better existing algorithms? The only reference I have been able to find is Steve Bellovin's draft-bellovin-hpw-01 using same basic method.

Specifically is it practically possible to increase the difficulty of someone with knowledge of 'pass1' to derive 'pass2' to more than the difficulty of guessing 'password' itself even if it requires spending portions of available 'password' entropy?

For example 'pass2' is exposed in an environment where it is being attacked "offline" while 'pass1' is less vulnerable. In this case 'pass1' is effectively also exposed to the "offline" risk as much as 'pass2'.