diff --git a/Site/2012-07/MasterPassword_PressKit.zip b/Site/2012-07/MasterPassword_PressKit.zip index cfce9285..679d31ce 120000 --- a/Site/2012-07/MasterPassword_PressKit.zip +++ b/Site/2012-07/MasterPassword_PressKit.zip @@ -1 +1 @@ -../Press/./MasterPassword_PressKit.zip \ No newline at end of file +../../Press/MasterPassword_PressKit.zip \ No newline at end of file diff --git a/Site/2013-05/MasterPassword_PressKit.zip b/Site/2013-05/MasterPassword_PressKit.zip new file mode 100644 index 00000000..c9cd0f3c Binary files /dev/null and b/Site/2013-05/MasterPassword_PressKit.zip differ diff --git a/Site/2013-05/algorithm.html b/Site/2013-05/algorithm.html index 5bd9b82c..69d21c13 100644 --- a/Site/2013-05/algorithm.html +++ b/Site/2013-05/algorithm.html @@ -19,89 +19,6 @@ - - - - - - - - - - - - - - - -
@@ -131,24 +48,30 @@ -Master Password is an algorithm used to generate unique passwords for websites, email accounts, or anything else based only on easily reproducible input.
The goal is a process that avoids all the problems involved with other password solutions.
The Master Password algorithm is open: this page describes its inner workings in detail. We believe the following is an important lesson we should all learn: Regardless of how much encryption a solution claims, if you don't know how it works, you cannot assume it is secure (at least, not the kind of secure you care about).
The user is expected to remember the following information: @@ -219,14 +142,14 @@
The purpose of this process is to deter any attempts at brute-forcing a user's master password from a known site password. The key derivation is done using the scrypt algorithm, which guarantees that the process sufficiently time- and resource-consuming to make brute-forcing an infeasible attack.
The key derivation is salted by the user's full name to prevent the generation of rainbow tables on the algorithm. This salt is not secret, and the user's full name is chosen because it is an input of sufficiently high entropy while being (hopefully) impossible to forget by the user.
-key = scrypt( P, S, N, r, p, dkLen ) - where - P = master password - S = "com.lyndir.masterpassword" . name length . name - N = 32768 - r = 8 - p = 2 - dkLen = 64+
key = scrypt( P, S, N, r, p, dkLen ) +where +P = master password +S = "com.lyndir.masterpassword" . name length . name +N = 32768 +r = 8 +p = 2 +dkLen = 64
With the master key
known, we can proceed to calculate a template seed
for the site. The template seed
is essentially the site-specific secret in binary form.
seed
are encoded according to the template
. The first seed
byte is used to determine which of the type's templates to use for encoding an output password. We take the byte value of the first seed
byte modulo the amount of templates
set for the chosen password type and use the result as a zero-based index in the templates
list for the password type.
- templates = [ "CvcvCvcvnoCvcv", "CvcvnoCvcvCvcv", "CvcvCvcvCvcvno", ... ] - template = templates[ seed[0] % count( templates ) ]+
templates = [ "CvcvCvcvnoCvcv", "CvcvnoCvcvCvcv", "CvcvCvcvCvcvno", ... ] +template = templates[ seed[0] % count( templates ) ]
Now that we know what template
to use for building our output password, all that's left is to iterate the template
, and produce a character of password output for each step. When we iterate the template
(index i
), we look in the character group identified by the character (string passChars
) in the template
at index i
.
@@ -258,8 +181,8 @@
We use the seed
's byte value at index i + 1
modulo the amount of characters in the character class to determine which character (passChar
) in the class to use for the output password at index i
.
passChar = passChars[ seed[i + 1] % count( passChars ) ] - passWord[i] = passChar+
passChar = passChars[ seed[i + 1] % count( passChars ) ] +passWord[i] = passChar
The result is an encoded passWord
string that contains the password generated for the site, such as: