I'm working on an app that will download files from external servers over https and store them on disk in a relatively secure way. Specifically, using a cryptographically unique IV, an AES256 cipher block, CTR block mode, and an HMAC hash of the encrypted data and IV.
One of the requirements of this project is that no duplicate files should be stored. Given the need for a unique IV to securely store the files, I can't simply use a hash of the encrypted file to see if the download is a duplicate. A sha256 or sha512 of the plaintext content isn't sufficient either because the client may download and store single character files making their contents easily guessed, potentially opening the system up to known plaintext attack vectors.
So I was wondering if it would be considered reasonably secure to store HMAC hashes of the plaintext, using an Argon2ID derived key as the HMAC signing key?
These hashes would be stored in a key/value database, and used as a lookup key to see if a downloaded file is one that we already have. The Argon2ID key will never be stored.