Show HN: Credential Shield Protocol – Server-blind breach checking for passwords

2 points

4 months ago

We're building an open protocol that lets organizations continuously audit credentials against breach databases WITHOUT exposing passwords, full hashes, or query results to any server.

The core approach: 1. Hash locally with Argon2 2. Send only first 4 chars of SHA-512 (32-bit prefix) to server 3. Server returns all prefix matches 4. Client verifies locally → server never learns outcome

Current state: Protocol spec + threat model + PowerShell client library. We're pre-funding and actively seeking feedback before building the reference implementation.

Try it: https://iamaxolotl-04.github.io/csp-2026/ Spec: https://github.com/IAmAxolotl-04/csp-2026

We'd love feedback on: - Where does this break in real deployments? - What operational constraints are we missing? - Would you use this in your environment?

Happy to answer questions in the comments.