Using Ed25519: The group size $\ell$ generated by the base point $G$ on the curve is approximately $2^{252}$. References below to 252-bit numbers refer to scalars less than $\ell$. The client has 127-bit entropy $e$, and picks a uniformly random 252-bit scalar $b$. The client uses $b$ as a blinding factor to derive the Pedersen commitment $C=eG+bH$. $H$ is a second well-known base point on the curve, picked using a 'nothing-up-my-sleeve' technique such that the discrete log of $H$ w.r.t. $G$ is unknowable. The client sends $C$ to the server, and the server picks random 127-bit entropy $e'$. The server sends $e'$ to the client. The client calculates the seed $s=e+e'$. The client calculates a second commitment $C'=C+e'G$, and the server also calculates the same value $C'$ for itself. This will mean that $C'=C+e'G==eG+bH+e'G==(e+e')G+bH==sG+bH$. At this point, the server could allow $H_{128}(C')$ as the identifier, where $H_{128}(\texttt{input})$ means to hash the input (using a cryptographically secure hash such as SHA512) and return the first 128 bits of the result. However, that would require the client to remember not only $s$, but also the blinding factor $b$. To solve this problem, the client now calculates the commitment $C''=sG+H_{252}(s)H$. $H_{252}(\texttt{input})$ means to hash the input using a cryptographically secure hash and return a 252-bit scalar as the output. The client creates a proof that $C''$ is a commitment to the same value $s$ as $C'$. This proof will allow the server to accept $H_{128}(C'')$ as an identifier because it knows it is based on the same value as $C'$, which itself is based on the server's entropy $e'$. This is achieved by providing a signature $\sigma$ (such as a simple Schnorr signature) proving knowledge of the private key $(H_{252}(s)-b)\ mod\ \ell$ for the public key $C''-C'$ on the base point $H$. This reason this signature proves that the commitments are to the same value is that unless $C''-C'$ causes the values on $G$ to cancel each other out, the discrete log of $C''-C'$ w.r.t $H$ is unknowable. The client sends $C''$ and $\sigma$ to the server. The server verifies the signature, and then records in its database that the identifier $H_{128}(C'')$ will be allowed. The client now only needs to remember the seed $s$, which will be the hash part of the URL used to access the encrypted resource. The client will reconstruct the identifier $H_{128}(sG+H_{252}(s)H)$, and will encrypt data using a symmetric key derived from $s$ (using a derivation technique such as HKDF-extract).