arXiv:2610.14300v2 Announce Type: replace Abstract: Credential-database disclosure exposes Internet of Things gateways, edge servers and legacy verifiers to offline password guessing. Memory-hard key derivation functions (KDFs) are preferred but can exceed constrained-device budgets. ARMOR addresses this deployment gap with a schema-preserving verifier-side transform for database-only compromise, assuming an isolated Chain Registry. The registry holds secret per-account chains of injective operations; fixed terminal escape encoding preserves distinct pre-hash values under each chain while moving outputs outside printable ASCII. This disrupts evaluated stock tools' candidate coverage, but chain-aware attackers can generate the transformed bytes directly. We therefore evaluate a bounded chain-aware attack on $1{,}000$ paired salted-MD5 targets: it executes $89.35\times$ the plain arm's counted salted checks, reproduced on A6000 and A100. All target passwords are in the bounded pool; same-target ambiguity enumeration and simulated login trials recover every original password. These results describe the implemented attack, not minimum attacker cost. Bare-metal transforms take microseconds, while protected storage dominates the measured TrustZone-M components; these are component measurements, not complete authentication times. ARMOR thus provides bounded chain uncertainty under registry isolation with low transform cost, although an isolated high-entropy pepper remains cryptographically stronger. ARMOR composes as KDF(ARMOR(password)) when resources permit and the KDF accepts the complete transformed output.