wouldn't salting and hashing be enough for this use case if you keep the salt on the client?