HN Showcase
Back to browse
Credential Shield Protocol – Server-blind breach checking for passwords

Credential Shield Protocol – Server-blind breach checking for passwords

by csp_dev·Feb 19, 2026·2 points·0 comments
Visit ProjectView on HN

AI Analysis

●●SolidBig BrainShip It
The Take

Feels like a practical riff on HIBP's k‑anonymity model — they add an Argon2 local prehash and a short SHA‑512 prefix to shift the threat model — which is interesting but not revolutionary. The repo already has a spec, threat model and a PowerShell client, yet there's no server reference and some details (their '4 chars = 32‑bit' claim, prefix-collision/load tradeoffs, rate-limiting and caching implications) need clearer operational analysis before you can trust it at scale.

Category
Security
Target Audience

Infosec teams, security engineers, identity engineers, SREs and orgs that audit credentials

Post Description

We're building an open protocol that lets organizations continuously audit credentials against breach databases WITHOUT exposing passwords, full hashes, or query results to any server.

The core approach: 1. Hash locally with Argon2 2. Send only first 4 chars of SHA-512 (32-bit prefix) to server 3. Server returns all prefix matches 4. Client verifies locally → server never learns outcome

Current state: Protocol spec + threat model + PowerShell client library. We're pre-funding and actively seeking feedback before building the reference implementation.

Try it: https://iamaxolotl-04.github.io/csp-2026/ Spec: https://github.com/IAmAxolotl-04/csp-2026

We'd love feedback on: - Where does this break in real deployments? - What operational constraints are we missing? - Would you use this in your environment?

Happy to answer questions in the comments.

Similar Projects