Suppose I want to implement a partial password scheme, where the user authenticates by using two passwords: one a normal password, the other is partial, where he only needs to type the selected three characters of that password:
I have previously asked about implementing this and it is obvious that simple approaches such as hashing individual characters fail completely. Suppose we are also barred from implementing a hardware authentication module that will store the password and just gives you a correct/incorrect answer for your input.
Another potential approach is using Samir's Secret Sharing, as described in details here with regard to the idea of partial passwords.
Roughly, we are providing an ability to recover a secret password (or its hash, which is better) by providing let's say 3 out of 8 chunks of data.
Is this scheme secure against brute force by an attacker who obtains access to the database, and by secure I mean secure at least to the same degree as a database of traditional salted and hashed passwords?