💻 computer science

CAYENNE+: HMAC-Derived Peppers for Compartmentalized Password Hashing

CAYENNE+ is a deterministic framework that enhances password security by deriving account-specific peppers from a master secret and per-user state, thereby mitigating the risks of broad compromise associated with static, globally shared peppers while maintaining low authentication overhead.

Original authors: Nathaniel Kofi Adjadeh, Oky Dicky Ardiansyah Prima, Masaki Narita

Published 2026-10-29

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Nathaniel Kofi Adjadeh, Oky Dicky Ardiansyah Prima, Masaki Narita

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, passwords remain the most common key to our online lives. They are simple to use, cheap to set up, and work with almost every system we own. To keep these passwords safe, computer systems do not store the actual words people type. Instead, they run the password through a complex mathematical machine that turns it into a scrambled code, known as a hash. This code is stored in a database. If a hacker steals that database, they see only the scrambled codes, not the real passwords. To make this even harder for attackers, security experts often add a secret ingredient called a "pepper." Think of this pepper as a hidden spice that the computer adds to the password before scrambling it. This secret is kept in a separate, highly protected vault, away from the database. If a hacker steals the database but not the vault, they cannot easily reverse the scrambling to find the original passwords.

However, a common weakness in this approach is that many systems use the exact same secret pepper for every single user. If a hacker manages to steal that one secret, they can unlock the protection for every account in the system at once. The entire defense collapses because the secret was shared too broadly. Researchers at Iwate Prefectural University in Japan have proposed a new way to handle this secret, called CAYENNE+. Instead of using one static secret for everyone, this new method creates a unique secret for each individual user. It does this by combining a master secret, kept in a secure vault, with a unique piece of data assigned to that specific user. The system then uses these two pieces to mathematically generate a custom pepper for that person. This means that even if a hacker steals the master secret, they still cannot crack the passwords for individual accounts without also finding the unique data for each person.

The researchers tested this idea by simulating a massive database breach. They created a system with two hundred thousand fake user accounts and set up different scenarios to see how long it would take a hacker to crack the passwords. In the first scenario, they assumed the hacker had no secret pepper at all. In the second, they assumed the hacker had stolen the single, shared secret used by traditional systems. In the third, they assumed the hacker had stolen everything: the database, the master secret, and the unique user data. Finally, they tested the most realistic partial compromise: the hacker had the database and the master secret, but the unique user data remained locked away in a separate, secure location.

The results showed that when the hacker had everything, the new system offered no extra protection beyond the standard scrambling method; the passwords were cracked at the same speed as before. This is expected, as the system relies on the secrecy of its components. However, the real value appeared in the partial compromise scenario. When the hacker had the master secret but lacked the unique user data, the time required to crack the passwords skyrocketed. In their simulations, the researchers found that the missing data forced the attacker to guess through a vast number of possibilities before they could even attempt to check a password. For the specific setup they tested, this increased the estimated time to crack half the accounts from roughly forty-five years to over four million years. This dramatic increase happened because the attacker had to try many different combinations of the missing user data for every single password guess, effectively multiplying the work required.

The study also looked at how this new method affects the speed of logging in for normal users. They measured the time it took for people to register and log in across different system sizes, ranging from ten thousand to two hundred thousand users. They found that for everyday logins, the new system added almost no noticeable delay. The time it took to log in was nearly identical to systems that used no pepper or a traditional shared pepper. The system was fast enough that users would not feel any difference. The researchers did test a version where the unique user data was changed periodically to renew the security. This renewal process required the system to re-calculate the password code, which did cause a slight slowdown, but only during the specific moments when the renewal happened. For the vast majority of logins, the system remained just as fast as before.

The researchers were careful to note that their findings came from simulations and controlled experiments, not from a real-world attack on a live system. They used a specific method to generate the unique user data that, in their test, created a limit on how many different outcomes were possible. They acknowledged that a real-world deployment would need to use a more complex method to ensure the number of possibilities is even larger. They also pointed out that if a hacker manages to steal both the master secret and the unique user data at the same time, the system offers no additional protection. The strength of the new approach relies entirely on keeping these two pieces of information in separate, secure locations so that stealing one does not automatically reveal the other.

Ultimately, this work demonstrates that it is possible to move away from the risky practice of using a single secret for everyone without slowing down the systems people use every day. By splitting the secret into two parts and keeping them apart, the system makes it much harder for attackers to succeed if they only manage to steal part of the information. The study suggests that this compartmentalization is a practical way to strengthen password security, provided that the two parts of the secret are truly kept separate in the real world. The researchers conclude that while the method does not replace the need for strong password hashing, it adds a vital layer of defense that reduces the damage caused by a partial security breach.

Technical Summary: CAYENNE+ – HMAC-Derived Peppers for Compartmentalized Password Hashing

Problem Statement
Passwords remain a dominant authentication mechanism due to their accessibility and compatibility with existing systems, yet they are frequent targets for database compromises. Modern defenses rely on password hashing (e.g., bcrypt, Argon2id) and salts to mitigate offline cracking. A "pepper"—a verifier-side secret stored separately from the password database—adds an additional layer of security. However, conventional peppering typically employs a single static pepper shared across all accounts. This creates a "broad compromise domain": if the static pepper is exposed, the additional protection is lost for every account relying on it. The paper argues that the security of the entire system becomes heavily dependent on the secrecy of one globally reused value.

Methodology
The study proposes CAYENNE+, a deterministic verifier-side framework that generates account-specific peppers rather than storing a single global secret. The framework operates as an additional layer above established password-hashing algorithms (specifically bcrypt in the experiments) and does not replace them.

Architecture: CAYENNE+ reconstructs an account-specific pepper on demand using two independently protected components:
1. A Master Secret ( $K_{secret}$ ): A global root of trust, assumed to be stored in a hardware-protected domain (e.g., HSM).
2. A Per-User Derivation State ( $k$ ): An account-specific value, stored in a separate protected domain.
Derivation Process: The pepper is derived deterministically using HMAC-SHA-256:
$D = \text{HMAC-SHA-256}(K_{secret}, U \parallel k)$
where $U$ is the user identifier. In the experimental implementation, the digest $D$ is mapped to a readable pepper format using a four-component modulo-10 reduction and a word pool, though the authors note this is an experimental profile for observability, not a deployment requirement.
Workflow: During registration or authentication, the system retrieves $K_{secret}$ and the user's $k$ , reconstructs the pepper, preprocesses the password via HMAC, and then hashes the result with bcrypt.
State Rotation: The framework supports a rotating configuration where the per-user state $k$ is renewed after a predefined number of successful logins, triggering the regeneration of the password verifier.
Threat Model: The study evaluates four scenarios:
1. N1: No pepper.
2. S1: Known static global pepper (conventional compromise).
3. R1: Full CAYENNE+ compromise (attacker has $K_{secret}$ and all $k$ values).
4. R2: Partial CAYENNE+ compromise (attacker has $K_{secret}$ and the database, but the per-user states $k$ remain protected).

Key Contributions

HMAC-Based Architecture: Defines a method for reconstructing account-specific peppers without storing the final pepper values, relying instead on a master secret and per-user state.
Explicit Threat Modeling: Introduces a specific threat model distinguishing between full compromise (R1) and partial compromise (R2), where one component remains protected.
Empirical Evaluation: Conducts bcrypt-based attack simulations and executable SHA-256 workflow validations to measure offline password-recovery costs. It also measures authentication performance (registration, login, throughput) across account scales of 10,000, 50,000, and 200,000.
Analytical Bounds: Analyzes how the configured per-user state range and the mapped-output space (cardinality) affect attack costs, specifically distinguishing between direct state enumeration and mapping-aware enumeration.

Results

Security (Offline Recovery):
- Under R1 (Full Compromise), CAYENNE+ offers no additional protection over the underlying bcrypt algorithm, as the attacker can reconstruct the pepper for every account.
- Under R2 (Partial Compromise), where the master secret is exposed but per-user states are not, the attacker must enumerate possible states.
- In the experimental setup ( $k_{max} = 100,000$ ), the R2-direct estimate (direct state enumeration) increased the estimated time to recover 50% of accounts ( $T_{50}$ ) from ~45 years (R1) to a value derived from the paper's calculations.
- The R2-map estimate (accounting for the experimental 10,000 distinct mapped outputs) reduced the bound to a value derived from the paper's calculations. The authors emphasize these are analytical extrapolations based on the specific experimental mapping, not guaranteed lower bounds for optimized attacks.
Performance:
- Non-Rotating CAYENNE+: Introduced negligible routine authentication overhead compared to no-pepper or static-pepper configurations. The deterministic reconstruction cost was dwarfed by the bcrypt verification cost.
- Rotating CAYENNE+: Introduced higher tail latency (P95) and reduced throughput because state rotation requires regenerating the bcrypt verifier after successful authentication. However, this cost was concentrated in specific renewal events rather than distributed across every login.
- Statistical analysis (Friedman tests) confirmed that while non-rotating configurations were statistically similar in mean latency, rotating configurations showed significant differences in tail latency and throughput due to the renewal overhead.

Significance and Claims
The paper claims that CAYENNE+ demonstrates the feasibility of verifier-side compartmentalization. Its primary significance lies in reducing the "broad compromise domain" associated with globally shared static peppers. By distributing the information required for pepper reconstruction across independently protected components, the framework ensures that the compromise of one domain (e.g., the master secret) does not automatically expose the information needed to crack all accounts.

The authors modestly state that CAYENNE+ is not a replacement for established password-hashing algorithms but an additional protection layer. Its security benefit is conditional on the genuine independence of the protected domains. The study concludes that while the framework introduces little routine overhead, the optional state rotation feature represents a trade-off between security (renewing verifier material) and performance (increased tail latency). The authors note that the experimental mapping used (modulo-10) limits the output space and that production deployments should utilize higher-cardinality mappings or direct cryptographic derivation to maximize security.

Technical Summary: CAYENNE+ – HMAC-Derived Peppers for Compartmentalized Password Hashing

More like this