I have an application in which a user must use a high-entropy salt to salt a message. Due to the fact that I can not rely on the user to actually provide a strong salt, the server must provide this salt instead.
The server needs to keep track of this salt so that it can later verify that a valid salt was used. This adds unfortunate statefulness.
However I was wondering if a stateless solution exists.
For example: Using an HMAC where the HMAC key is a server secret and the HMAC message is not a reliable secret at all (a username, for instance). The benefit of this would be that the server can statelessly verify valid server-generated salts. However, this seems like a dangerously "clever" solution that probably has a huge lurking flaw I'm unaware of.
Is this reasonable, or is there some other solution to this problem that is well vetted?