I use usernames encrypted using a function f as ids of records. Users see records identified by f(username). I must not know real usernames.
I want to be protected from attack when adversary who has a username u1 and knows f generates another username u2 such that f(u1) = f(u2), logs in with this username and sees the data of user with username u1.
So, f must be:
- deterministic: I use f(x) as identifier. It rejects RSA encryption with throwing out secret key.
- one-way: I must not be able to get a real value from encrypted value.
- collision-free to prevent attack describes above. It rejects md5/sha because as far as I understand they are easily crackable, especially because I don't use salt (unavoidable technical reasons).
- quick to compute: I must handle tens of thousands messages per second. It rejects b/crypt.
Note that I don't care about length of output (it may be fixed or variable).
I was looking at MAC and Digital Signature algorithms but can't figure out which of them have required properties.