Password to password mapping

Question

DISCLAIMER: I understand the question might be a bit amateurish due to my limited knowledge of cryptography but, please, bear with me for a minute.

QUESTION: Suppose a user Alice generates a pass phrase "hello", and a user Bob generates another pass phrase "world".

I need to create an encryption/hashing pipeline that would map Alice's pass phrase to Bob's pass phrase. I'll illustrate the basic idea of what I'm trying to achieve:

"hello" --> [encryption pipeline] -> "world"

The pipeline is unidirectional, as illustrated. The database of the server hosting the pipeline CANNOT store plain text pass phrases. It can store hashed or encrypted modifications of the pass phrases though, the basic goal is to make it impossible/immensely difficult to derive "world" without knowing that the original input is "hello" (say in a scenario where the database is compromised)

How could one securely implement such a pipeline and abide with common security principles? I've just started digging deeper into hashing/encryption algorithms, Levenshtein distance, etc. but I would really like to get an insight from someone who's a lot more knowledgeable in this area than myself.

Answer 1

The simplest solution to this would be to encrypt Bob's pass phrase under Alice's pass phrase.

In particular the following steps would be carried out for that:

1. Generate a salted password hash (using e.g. Argon2 or bcrypt) from Alice's pass phrase, call it $SK$
2. Use $SK$ to encrypt Bob's pass phrase symmetrically, e.g. using AES-GCM

If you want to be fancy and allow Bob to update his pass phrase you can also symmetrically encrypt a private asymmetric key in step 2 and use the corresponding public key to encrypt the new pass phrase whenever Bob updates it.

This can also be integrated into the standard password-hash based authentication flow by using a fast hash (like a SHA256) of $SK$ as the stored database hash value.