We have a website which stores hashed passwords in the database. During logins we hash the password entered by user and compare two hashes. This is quite standard so far. Our client which is in finance domain now wants us to implement a feature where we would ask users to enter few random characters from their password. This is similar what most banks do during a 3D secure payment (Enter 3rd, 5th and 8th digit of your password).
I understand that this would impossible on a password whose hashed version is already stored in the database. Or is it possible? Am I missing something obvious?
For new users, I am thinking I can hash every character separately and store the hashes. When user enters the random password characters then I can hash the entered characters and compare the hashes. But I am not sure if this would reduce the security.
Another option could be to create many combinations of 3 random characters from the user's password, hash the combinations a d store the hashes along with positions of the characters and made the combination. This might be silly but I am just stretching my imagination.
How is this done in reality?