I would like to ask about vulnerabilities of the following algorithm for a password manager.
It is structured as follows:
There is a master password UTF-8 10 characters long, not to be stored anywhere.
For each password, the following information is saved into a database file:
- Account name.
- Randomly generated UTF-8 4 characters string.
- Rules for password: e.g. at least one digit, one special character within ..., etc.
Then the user has to think of an algorithm of its own choice to get by hand a 3-digit number from the account name, for example through a table that maps the characters of the account name to 0-9 digits. This number will be entered manually.
We then concatenate the characters of the master password at the positions defined by the digits of the above 3-digit number to make a 3-character string.
We concatenate the above 3-character string with the randomly generated 4 characters string in the database, and then hash it with SHA256.
Then there is an algorithm that given the hash value and the rules in the database, gets a unique valid password.
Let's say that we save the database in clear.
Is this algorithm safe enough? Would it be better to encrypt the database with the master password? Does the "by hand" algorithm, to be chosen by the user, add some security or not? Other hints or comments?
