1
$\begingroup$

It is a general question, but I'm using SHA-2.

My reason is to take a short pin or string and to generate a longer hash of that pin to locally generate a local key for personal use to be used to generate other passwords based on a domain and user name.

Eg. 

Site password = Hmac( Hmac(pin,pin), Domain + username)

Or

Site password = Hmac( Hmac(pin,pin), hmac(Domain + username))

Additional info: Random passwords, unique for each account is ideal. But then I need to trust a password manager and install it on every device I own or use - this seems worse as I already trust Chromium/Google to store my passwords - why introduce another party? - and it seems popular password managers are patching design and implementation flaws a few times a year (and my code is no different).

My aim is to make any released passwords or hashes so long and pattern-free that my hashed passwords would remain un-cracked. And if cracked, then only one account would be compromised.

This is the idea I'm working on, it is not my idea, just my implementation.

In doing so I wondered if hmac(key,key) leaked info about the key or perhaps was trivial to crack. So after finding nothing on first page of a google search I decided to ask the SE community.

Improve this question
$\endgroup$
4
  • 7
    $\begingroup$ Why use a hmac? Why not a secure hash function directly, or better yet a KDF like PBKDF2 or Argon2 or Scrypt. $\endgroup$
    – Awn
    Mar 10, 2017 at 8:24
  • $\begingroup$ Ignorance is my excuse. Pbkdf2 requires a salt. I assume I can pick any random number but then I would need to remember it as well as pin. Seems like I'd need to pbkdf2(sha512hmac,key,key,1000,64) which seems similar to my question. I'll look at Argon2 and scrypt... Ta. $\endgroup$
    – philcolbourn
    Mar 10, 2017 at 8:41
  • $\begingroup$ You really should use a password manager and randomly generate passwords. This way a compromised password will not leak information on the others. $\endgroup$
    – A. Hersean
    Mar 10, 2017 at 12:55
  • $\begingroup$ I don't trust password managers and I shouldn't trust Google but I do for now. Google Chrome seems to be moving towards being a password manager and generator (it offered to generate a password for me once so far) but I'm looking to learn and play around with something for myself. $\endgroup$
    – philcolbourn
    Mar 10, 2017 at 13:56

1 Answer 1

Reset to default
3
$\begingroup$

This is all useless.

The point of hashing passwords is to prevent a hacker who obtained the database with the hash to retrieve the original password.

With a short pin (assuming 4 digits) a hacker will simply calculate your hmac for all 10000 possible codes. None of your variations will make any significant difference.
A secure hash will hardly help either.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Yes I know this. I'm not concerned about this scenario although I'd be unlikely to use a 4 digit pin - sorry for misleading you. In any case, if someone gets my PC then I suspect they will be able to get all my passwords directly from Chromium. $\endgroup$
    – philcolbourn
    Mar 10, 2017 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.