I've been thinking about creating strong and unique passwords for my online accounts, but I also want them to be memorable. I've come across the idea of using a memorable passphrase as the basis for a complex password generation. Specifically, I'm considering hashing the passphrase to generate the complex password, such as hash function like SHA-256 or bcrypt to convert the passphrase into a fixed-length hash. This hash will serve as my complex password, usually for PGP keys or encrypted database for other passwords.
Example: input > MD2 > Base85 (=password)
- Input passphrase: password
- MD2: f03881a88c6e39135f0ecc60efd609b9
- Base85: AhZ##3&[email protected]@q.DNAS,I20KET&
That gives entropy of 210 bit. Yet, the input is extremely poor.
I'd love to hear your thoughts and any advice you might have on this approach. Is it a good idea for creating strong passwords that are also easy to remember in such a way having a scheme? Are there any security concerns or best practices I should keep in mind, ora any other tools for that purpose?
After reading several comments I try to understand the concept. First, I didn't say that only hashing will make my password "safe". My initial question would mean: Why would having a strong passphrase be equally "strong" as "passphrase + flushing through various hashes, rotations and encryption methods"? In the former case the attacker needs to go through brute force of the plain-password phrases, in the latter case he needs to do the first phase of attack first to proceed to the second, and having in mind how many combinations and rotations one can imagine, it is adding an extreme layer of difficulty.
Let me explain a bit more sophisticated, instead:
- Input: мой password is חזק
- DES Encrypt: Key ("MySecret" Latin1), IV (密码01 UTF8), CBC, In/Out:Raw
- Base85 (output password): Lkp.F?sa:8g^-4..,^E5:iF+SFV<s<
So, I have made by purpose all input in different languages. In reality it can be something equally complex yet very easy to remember. By having 密码01 - as an obvious example, I can create several passwords by increasing it to 密码02. The next password would result in: GHpS9fl'b8C*QImok46gDm4K"bO=qq