Encrypting variable-length passwords to yield fixed-length encrypted passwords

An apparatus comprising:

• a memory configured to:
• store logic configured to perform a key derivation operation, the key derivation operation comprising a pseudorandom function;
• and
• store logic configured to perform a cipher-based message authentication code (CMAC) function;
• and
• a processor configured to perform the following for each input password of a plurality of input passwords to yield a plurality of encrypted passwords, at least two input passwords having different lengths, the encrypted passwords having the same length:
• receive an input password and a random number;
• derive an encryption key from the input password and the random number according to the key derivation operation;
• receive the encryption key and a user identifier;
• and
• generate an encrypted password from the encryption key and the user identifier according to the CMAC function.

A computer-readable medium storing logic when executed by a processor configured to:

• perform the following for each input password of a plurality of input passwords to yield a plurality of encrypted passwords, at least two input passwords having different lengths, the encrypted passwords having the same length:
• receive an input password and a random number at logic configured to perform a key derivation operation, the key derivation operation comprising a pseudorandom function;
• derive an encryption key from the input password and the random number according to the key derivation operation;
• receive the encryption key and a user identifier at logic configured to perform a cipher-based message authentication code (CMAC) function;
• and
• generate an encrypted password from the encryption key and the user identifier according to the CMAC function.