I can't think of any way that this could be made secure outside of specialized hardware. If a system exists that can query some static data for whether a selected subset of characters is correct, then brute-forcing the underlying password becomes stupidly trivial.

Similarly for pre-hashing certain subsets; a four-character password can be too easily brute forced.