Is there a cryptographic hash function that can be performed with pencil and paper?

Question

Imagine I'm signing up for the 99th new web site this month. I somehow take my secret key (which I have written down on a card in my wallet) and the domain name of the site and feed them both into some algorithm (perhaps a HMAC?), and type the resulting hash into the "password" field of the registration form.

Later, I'm at the library and I want to log in to that one particular site, but I don't have my phone and the computers at the library are locked down so I can't install any new software, so I want to reconstruct that password "by hand".

• Is it reasonable to use Kerckhoffs's principle and assume that everyone knows exactly which hash algorithm I'm using, and assume every knows I use exactly the exactly the same hash algorithm and exactly the same secure key for web site all 99 web sites that I've signed up for this month?

• It would be nice if somehow, even if the sysadmins for websites 1 through 98 all conspire together and share with each other the "password" I gave each one (and they know the algorithm I'm using), the hash is secure enough that finding the password for website 99 is harder than brute-forcing a random 8-character password.

• It would be nice if somehow, even if all 99 sysadmins conspired together and shared the "password" I gave each one, the hash is secure enough the recovering my secret key is harder than brute-forcing a random 16-character password.

• The amount of secret information I have to write down and put on a card in my wallet and keep secret should be shorter than simply making up a fresh new random 10 character password for each of 100 websites and adding the domain name and the new password to the card. (Perhaps 256 bits of information is reasonable? Perhaps encoded into 80 decimal digits or 55 lowercase letters or 20 Diceware words?).

• I'm in a relatively private cubicle at the library -- I can write stuff on my pad of sticky notes, manipulate my deck of cards, perhaps do some calculations on a 5-function calculator, look up a passage from my copy of "The Good Soldier Schweik", that everyone knows I always carry with me, etc. But not run a computer program. (Let's assume I eat any sticky notes that might leak secret information). This should make it easier than " Are there cryptographic hash functions that can be computed using only paper and pen without leaking any information about the plaintext? " because I can write down secret information.

Is there any pencil-and-paper algorithm that meets these criteria?

Answer 1

I don't think doing this by hand is the right way to do this. Pencil and paper systems are unreliable because humans just aren't as good at being robots as, well, robots! Most of the work in computing a secure MAC is hugely monotonous and a single mistake, anywhere during the process, could completely destroy any security you thought you had.

If your library computer has web access, then it executes Javascript with very high probability. Javascript is enough to conquer this problem.

Just create a static HTML with some Javascript in it. You have two HTML input fields with a single button. When you click, it computes the $HMAC(site,password)$ using SHA-256 or something, then encode the result as printable characters.

There is the problem of key loggers etc, grabbing your master password but they could just as easily covertly film you as you carry out the computation by hand!

There's a limit to the countermeasures that be deployed when the machine is fundamentally untrusted. However, you can mitigate against key loggers by simply making the master password be entered, character by character, via a dropdown box.