I'm using a registration function that hashes the email in PBKDF2 with a random and unique Salt each time. The hashes email and his salt are saved in the DB. No problem with that. The problem is that now I want to make sure that users only create one single account per email. Obviously to verify that I need to check my DB and that's where the problem starts. I either lose in security or in time.
Because as I see it I have 2 choices:
1 - I change my hash method and use a common Salt for all emails. Which make me lose a bit of security.
2 - I hash the email with all the Salts from the DB and check for matches. My guess is that this will be horribly slow.
So my question are:
- What should I do? Optimize security or "time"?
- Maybe hashing emails with unique and random salts in PBKDF2 is too much? If yes, what hashing method should I use?
- Is there any other solution?
PS: I didn't post any code because I think this is more of a theory discussion but if code is needed let me know, I will add it.