3
$\begingroup$

I have to change local administrator passwords on machines. I don't want to store password in a database. I have to generate a password that I can find later to connect to the machine again. So I periodically generate a secret random string (stored in a database) and make a hash of it with the machine name. At this point I want to know how to generate a password from this hash (following current good practices) and I want to find the most secure way to do it.

So… I have to generate a password (in Python and following current good practices) from SHA-512. How can I do that? And what about security aspects concerning the password generation and the generated password?

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
2
$\begingroup$

So your idea is to effectively turn the password authentication into a key-based authentication by deriving the machine passwords from a single random key stored elsewhere. Assuming key storage is secure (probably encrypted with a strong password), this is sound.

It would be better to just use the asymmetric key-based authentication built into most remote access tools (like ssh), so that you don't mess up anything by rolling your own crypto. But if you need to use password authentication, your idea is not insecure either.

Actually generating the password / passphrase from a SHA-512 hash (or any seed material), it's a fairly mechanical process:

  1. Choose the alphabet (or dictionary). For passwords you might use hex or base64, for passphrases any conveniently sized dictionary will do.
  2. Choose the bit-strength. 128 bits is sufficient, but may result in quite long passwords. OTOH, there's no use making it longer than input entropy.
  3. Consume the input bits to generate characters/words until you have a sufficiently long password. With a hashed input like SHA-512 you can just use the first bits from either end, with a non-mixed seed you should probably hash it first (with a strong password hash if entropy is low).
Improve this answer
$\endgroup$
7
  • $\begingroup$ I'm writing a Python program that (every 7 days) change local administrator password automatically. My program use Ansible to connect to these machines via SSH for GNU/Linux and Winrm for MS Windows. It needs to know the machine password in order to make a connection on it. $\endgroup$
    – user25770
    Commented Jul 24, 2015 at 7:34
  • 1
    $\begingroup$ @user25770, if you already use ssh, you should just switch to key based authentication. If you can't (e.g. due to the Windows program that I'm not familiar with), your idea of deriving passwords from a random seed seems sound... assuming you store the seed securely elsewhere. $\endgroup$
    – otus
    Commented Jul 24, 2015 at 7:46
  • $\begingroup$ (However, I'm not sure why you'd want such frequent changes.) $\endgroup$
    – otus
    Commented Jul 24, 2015 at 7:47
  • $\begingroup$ 7 days was an example, by the way thanks for the link. I'd like to get an example of a short Python implementation to get started please. $\endgroup$
    – user25770
    Commented Jul 24, 2015 at 8:07
  • 2
    $\begingroup$ @user25770, this isn't really the place for coding help, but in Python simply truncating the hex digest should do: .hexdigest()[:32]. $\endgroup$
    – otus
    Commented Jul 24, 2015 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.