Outside of professional carrier, I often stumble upon a need for a unique password for exp. for local database, game server, or on tons of, not so important, websites.
I came up with an idea to write a deterministic password generator for myself, which takes a tuple:
- master password
- header for exp. just a word "pinterest" and generates a password of specified length, always the same
and generates a password of specified length, always the same.
I realise that this idea may not be the most secure and etc. But please focus on proper implementation, not the concept.
The implementation:
- Process master password and header using a password hash function like balloon hashing or argon2 (I believe that it adds some computational effort and makes it harder to obtain the master password from a few generated passwords)
- Use the result of 1. as a seed for Fortuna DRNG to generate the password
Are my assumptions about point 1. correct? Would you suggest some more operations?
How should I process master password and header? Can I simply concatenate them and hash, or XOR their hashes, or compose?