deterministic password generator idea

Question

Outside of professional carrier, I often stumble upon a need for a unique password for exp. for local database, game server, or on tons of, not so important, websites.

I came up with an idea to write a deterministic password generator for myself, which takes a tuple:

• master password
• header for exp. just a word "pinterest"

and generates a password of specified length, always the same.

I realise that this idea may not be the most secure and etc. But please focus on proper implementation, not the concept.

The implementation:

1. Process master password and header using a password hash function like balloon hashing or argon2 (I believe that it adds some computational effort and makes it harder to obtain the master password from a few generated passwords)
2. Use the result of 1. as a seed for Fortuna DRNG to generate the password

Are my assumptions about point 1. correct? Would you suggest some more operations?

How should I process master password and header? Can I simply concatenate them and hash, or XOR their hashes, or compose?

Answer 1

I would suggest less operations :-)

Use Argon2 directly as that's what it's for. So you'd do something like this:-

echo "master_password"   |   argon2    header_needs_to_be_longer -t 1000 -p 10 -k 10000

in the *nix world.

That then produces:-

Type:       Argon2i
Iterations: 1000
Memory:     10000 KiB
Parallelism:    10
Hash:       16e4848c0274617768dac792518fd60d74df6233c0f7d4b90df22f009ae177fd
Encoded:    $argon2i$v=19$m=10000,t=1000,p=10$aGVhZGVyX25lZWRzX3RvX2JlX2xvbmdlcg$FuSEjAJ0YXdo2seSUY/WDXTfYjPA99S5DfIvAJrhd/0
6.435 seconds
Verification ok

The hash is 256 bits which should be plenty, and is always repeatable and secure.