You can do the slow pbkdf2 hash on your webserver and use the result for your st...

koolba · on April 3, 2021

No you can’t. To do the hash you need the per user salt before you start hashing. Which would require reading from the DB.

mvolfik · on April 3, 2021

Then you can retrieve salt, do hash on server, and use the stored procedure to compare. More requests, but a tradeoff for security \o/

tpetry · on April 5, 2021

There is no reason you can‘t have a deterministic function which generates a hash for the user.

A simple sha256(lower(email)) is equally secure as a complete random salt, the only requirement on a salt is to be unique.