1
$\begingroup$

It is a general question, but I'm using SHA-2.

My reason is to take a short pin or string and to generate a longer hash of that pin to locally generate a local key for personal use to be used to generate other passwords based on a domain and user name.

Eg.

Site password = Hmac( Hmac(pin,pin), Domain + username)

Or

Site password = Hmac( Hmac(pin,pin), hmac(Domain + username))

Additional info: Random passwords, unique for each account is ideal. But then I need to trust a password manager and install it on every device I own or use - this seems worse as I already trust Chromium/Google to store my passwords - why introduce another party? - and it seems popular password managers are patching design and implementation flaws a few times a year (and my code is no different).

My aim is to make any released passwords or hashes so long and pattern-free that my hashed passwords would remain un-cracked. And if cracked, then only one account would be compromised.

This is the idea I'm working on, it is not my idea, just my implementation.

In doing so I wondered if hmac(key,key) leaked info about the key or perhaps was trivial to crack. So after finding nothing on first page of a google search I decided to ask the SE community.

$\endgroup$
  • 7
    $\begingroup$ Why use a hmac? Why not a secure hash function directly, or better yet a KDF like PBKDF2 or Argon2 or Scrypt. $\endgroup$ – Awn Mar 10 '17 at 8:24
  • $\begingroup$ Ignorance is my excuse. Pbkdf2 requires a salt. I assume I can pick any random number but then I would need to remember it as well as pin. Seems like I'd need to pbkdf2(sha512hmac,key,key,1000,64) which seems similar to my question. I'll look at Argon2 and scrypt... Ta. $\endgroup$ – philcolbourn Mar 10 '17 at 8:41
  • $\begingroup$ You really should use a password manager and randomly generate passwords. This way a compromised password will not leak information on the others. $\endgroup$ – A. Hersean Mar 10 '17 at 12:55
  • $\begingroup$ I don't trust password managers and I shouldn't trust Google but I do for now. Google Chrome seems to be moving towards being a password manager and generator (it offered to generate a password for me once so far) but I'm looking to learn and play around with something for myself. $\endgroup$ – philcolbourn Mar 10 '17 at 13:56
3
$\begingroup$

This is all useless.

The point of hashing passwords is to prevent a hacker who obtained the database with the hash to retrieve the original password.

With a short pin (assuming 4 digits) a hacker will simply calculate your hmac for all 10000 possible codes. None of your variations will make any significant difference.
A secure hash will hardly help either.

$\endgroup$
  • $\begingroup$ Yes I know this. I'm not concerned about this scenario although I'd be unlikely to use a 4 digit pin - sorry for misleading you. In any case, if someone gets my PC then I suspect they will be able to get all my passwords directly from Chromium. $\endgroup$ – philcolbourn Mar 10 '17 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.