jaseg/gist:3334991

## gistfile1.md

      
    Raw
  

              gistfile1.md
            
          
    Prelude

Since password managers are big and complicated and I currently am pretty bored since I am sitting in a car for a few hours, here is a simple algorithm to generate resource-specific, unique passwords using a master password and no password database.
WARNING

As pointed out here: http://news.ycombinator.com/item?id=4374888 this method is broken.
Usage

Simply paste the following line into a shell, type your master password (correctly, please, for there are no safeguards in place to protect you from typos) and press [enter] [ctrl-d] and you will be provided with a secure password specific for www.example.com.
(sha512sum ~/.salt -<<<www.example.com;sha512sum -)|cut -d\  -f1|sha512sum|cut -c-32
Please not that this line will produce the same password every time you invoke it, provided that nobody messed around in your .salt file and you still remember your master password.
The salt can be pretty much any immutable file (i.e. .jpg and other files which tend to be modified by programs because of stored metadata are a really bad idea), as long as it is more or less unique. I generated mine with the following command line:
(dmesg;env;head -c16 /dev/random)|sha512sum>>~/.salt; chmod 400 ~/.salt
Under certain circumstances, this line may take a few seconds while /dev/random gathers entropy.
Principle of operation

The password generate takes hex sha512-hashes of your salt file, your master password and the resource name you wish to generate a password for (i.e. e.g. a domain name), concatenates them one per line, hashes the result and takes the first 32 characters of the result's hex value. The resulting value is dependant on each of the three variables and no one of the variables can be computed from it (these are properties of cryptographic hashes as sha-512 is one).
Obviously, the process could be improved if you would find a portable way to encode the resulting hash in a charset consisting of more than 16 digits, for then the resulting password could be made significantly shorter than 32 characters without loosing any entropy compared to now.
The salt file generation takes your dmesg (system-specific), your env (user specific) and a few random bytes (random), concatenates and hashes them, and puts the hash's hex string into the salt file.