I want to make a service stateless(has no data to store or mantain). But the service shoule be able to authenticate user.
What I'm considering is using key derivation function with a shared master secret key and username to calculate user password each time when user login. The KDF should ensure it generates the same password everytime for specific user. The service will deliver the derived password to correspond user.
For example, use PBKDF2 and use username+secret_shared_master_key as the password, kinda like a
username-based key derivation function
I'm wondering is this way secure cryptographically? Thanks in advance!
After some discussion with SteffenUllrich in comments, seems using
HMAC(secret_master_key, username) or
PBKDF2(HMAC(secret_master_key, username)) as the user's password is one option to do the thing.