I have an application in which a user must use a high-entropy salt to salt a message. Due to the fact that I can not rely on the user to actually provide a strong salt, the server must provide this salt instead.

The server needs to keep track of this salt so that it can later verify that a valid salt was used. This adds unfortunate statefulness.

However I was wondering if a stateless solution exists.

For example: Using an HMAC where the HMAC key is a server secret and the HMAC message is not a reliable secret at all (a username, for instance). The benefit of this would be that the server can statelessly verify valid server-generated salts. However, this seems like a dangerously "clever" solution that probably has a huge lurking flaw I'm unaware of.

Is this reasonable, or is there some other solution to this problem that is well vetted?

  • $\begingroup$ Could you perhaps be a bit less obtuse about the actual application? Details matter. It sounds as though you're implementing client-side password hashing or key derivation in a web browser, but if that isn't the application some answers may not apply. $\endgroup$ – rmalayter Oct 18 '16 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.