Year: 2026
Type: preprint
Abstract: Passwords remain widely used because they are simple, accessible, inexpensive to deploy, and compatible with existing authentication systems. To strengthen stored password hashes, many systems add a verifier-side secret known as a pepper. However, conventional peppering commonly uses one static pepper across many accounts, creating a broad compromise domain if that secret is exposed. This study proposes CAYENNE+, a deterministic verifier-side framework that derives an account-specific pepper from two independently protected components: a master secret and a per-user derivation state. CAYENNE+ operates as an additional layer above established password-hashing algorithms and uses HMAC-SHA-256 for deterministic pepper derivation. The framework was evaluated through bcrypt-based attack simulation, executable SHA-256 workflow validation, and authentication-performance experiments under no-pepper, known-static-pepper, full-compromise, and partial-compromise conditions. Under the evaluated partial-compromise condition, where the master secret is exposed but the per-user derivation state remains unavailable, the missing state increases the estimated work required for offline password recovery. Non-rotating CAYENNE+ introduces little routine authentication overhead, while state rotation periodically renews verifier material at the cost of higher tail latency. With $k_{\max}=100{,}000$, direct state enumeration gives a naive 100,000-state search bound, whereas the evaluated four-component modulo-10 mapping produces at most 10,000 distinguishable mapped outputs. Overall, CAYENNE+ demonstrates how account-specific pepper derivation and independently protected verifier components can reduce the broad compromise domain associated with globally shared static peppers.
Source: Research Square
Institution: Iwate Prefectural University
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7224107534