0
$\begingroup$

I'm new to cryptography, so please bear with me as I try to explain what's going in my head. I have an idea to write a program to generate one-time passwords for online conferences that are although password protected, due to their large scale, often passwords are widely circulated leading to uninvited attendees causing a mayhem of sorts, if you will. The solution in my head is to use cryptography to generate user-specific passwords.

A server-side API generates a password with 4 parameters

Leak_password <= some_hash_fn(original_password, Server_password, conference_id, user_email)

A server-side API can identify a user_email from Leak_password, Server_password, original_password

Leak_password ⊗ (Server_password, original_password) => user_email

A server-side API can identify a user_email from Leak_password, Server_password, original_password

Leak_password ⊗ (Server_password, user_email) => original_password

Anyone can verify if Leak_password was generated for conference_id

Leak_password ⊗ conference_id => true/false

My questions

  1. Is there a name to the problem I am trying to solve? Keywords would help me narrow down my research.
  2. Do you have ideas how this problem can be solved? Again, true to spirit of stack exchange, I'm not asking for an answer, but merely a direction.
$\endgroup$
1
  • 1
    $\begingroup$ Do you need the hash function and passwords at all? Is it not enough to have 32B_random_token joined by user_email (and possibly conference id etc.)? The added benefit is that it's rather obvious that this "password" comes back to the user, so they might be less willing to share it. $\endgroup$ – domen Oct 7 '20 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.