CAYENNE+: HMAC-Derived Peppers for Compartmentalized Password Hashing

Abstract Passwords remain widely used because they are simple, accessible, inexpensive to deploy, and compatible with existing authentication systems. To strengthen stored password hashes, many systems add a verifier-side secret known as a pepper. However, conventional peppering commonly uses one static pepper across many accounts, creating a broad compromise domain if that secret is exposed. This study proposes CAYENNE+, a deterministic verifier-side framework that derives an account-specific pepper from two independently protected components: a master secret and a per-user derivation state. CAYENNE+ operates as an additional layer above established password-hashing algorithms and uses HMAC-SHA-256 for deterministic pepper derivation. The framework was evaluated through bcrypt-based attack simulation, executable SHA-256 workflow validation, and authentication-performance experiments under no-pepper, known-static-pepper, full-compromise, and partial-compromise conditions. Under the evaluated partial-compromise condition, where the master secret is exposed but the per-user derivation state remains unavailable, the missing state increases the estimated work required for offline password recovery. Non-rotating CAYENNE+ introduces little routine authentication overhead, while state rotation periodically renews verifier material at the cost of higher tail latency. With $k_{\max}=100{,}000$, direct state enumeration gives a naive 100,000-state search bound, whereas the evaluated four-component modulo-10 mapping produces at most 10,000 distinguishable mapped outputs. Overall, CAYENNE+ demonstrates how account-specific pepper derivation and independently protected verifier components can reduce the broad compromise domain associated with globally shared static peppers.