So, let's say I have a secret message I want to encrypt and store in my database, from where an authenticated user can retrieve, decrypt, read, update the message.
EDIT: the issue I'm encountering is this: It doesn't make sense to use the same password for authorization and decryption. Usually, a hashed password is stored in the database in order to verify the user. But if I use the hash password for encrypting the message too, then all a hacker needs to do once he sees the database is decrypt the message with the hashed password
From doing some stackoverflow searches (http://stackoverflow.com/questions/2388256/secure-encrypted-database-design?rq=1), now correct me if I understood it incorrectly, it seems as if the solution is to encrypt the secret message with public keys, decrypt the message with private keys, and then symmetrically encrypt these private keys with user passphrases. The encrypted private keys can then be stored in the database. So in sum, this is how it works: the user provides a passphrase, which decrypts the private key as stored in the database, which is then used to decrypt the secret message as stored in the database.
Now, my question is this: can you use the passphrase for both authentication and decrypting the message? I don't want hackers to be able to guess passphrases until the private key is successfully decrypted, so some user authentication (i.e. username, password, store hashed password in database) would be good. However, the idea of having to enter both a password for authentication and a passphrase to decrypt the message seems excessive.
I believe I may be misunderstanding the linked post, but my ultimate question is how can I structure the security system so that the message may be encrypted in the database (in the event that someone gets unauthorized access into the database) without having one person's password being the key to the decryption.