# How can I generate a good password from a SHA512 hash?

I have to change local administrator passwords on machines. I don't want to store password in a database. I have to generate a password that I can find later to connect to the machine again. So I periodically generate a secret random string (stored in a database) and make a hash of it with the machine name. At this point I want to know how to generate a password from this hash (following current good practices) and I want to find the most secure way to do it.

So… I have to generate a password (in Python and following current good practices) from SHA-512. How can I do that? And what about security aspects concerning the password generation and the generated password?

So your idea is to effectively turn the password authentication into a key-based authentication by deriving the machine passwords from a single random key stored elsewhere. Assuming key storage is secure (probably encrypted with a strong password), this is sound.

It would be better to just use the asymmetric key-based authentication built into most remote access tools (like ssh), so that you don't mess up anything by rolling your own crypto. But if you need to use password authentication, your idea is not insecure either.

Actually generating the password / passphrase from a SHA-512 hash (or any seed material), it's a fairly mechanical process:

1. Choose the alphabet (or dictionary). For passwords you might use hex or base64, for passphrases any conveniently sized dictionary will do.
2. Choose the bit-strength. 128 bits is sufficient, but may result in quite long passwords. OTOH, there's no use making it longer than input entropy.
3. Consume the input bits to generate characters/words until you have a sufficiently long password. With a hashed input like SHA-512 you can just use the first bits from either end, with a non-mixed seed you should probably hash it first (with a strong password hash if entropy is low).
• I'm writing a Python program that (every 7 days) change local administrator password automatically. My program use Ansible to connect to these machines via SSH for GNU/Linux and Winrm for MS Windows. It needs to know the machine password in order to make a connection on it. – user25770 Jul 24 '15 at 7:34
• @user25770, if you already use ssh, you should just switch to key based authentication. If you can't (e.g. due to the Windows program that I'm not familiar with), your idea of deriving passwords from a random seed seems sound... assuming you store the seed securely elsewhere. – otus Jul 24 '15 at 7:46
• (However, I'm not sure why you'd want such frequent changes.) – otus Jul 24 '15 at 7:47
• 7 days was an example, by the way thanks for the link. I'd like to get an example of a short Python implementation to get started please. – user25770 Jul 24 '15 at 8:07
• @user25770, this isn't really the place for coding help, but in Python simply truncating the hex digest should do: .hexdigest()[:32]. – otus Jul 24 '15 at 9:04