I am using the PKCS#5 standard to generate a key using a random and unique salt and the user's password in input. Consider this key as the "encryption" key.
The "encryption" key is used to encrypt a random AES key. Each user has an AES key associated to their profile.
So, a user's profile will contains this information:
- password hash for authentication purpose.
- salt used in the PKCS#5 algo. (From the PKCS#5 V2.0 documentation, we know that this information needs no protection).
- the encrypted AES key generated randomly and encrypted with the "encryption" key generated by the PKCS#5 algo with the salt and the user's password.
I was asking myself if it is dangerous to be in possession of the password's hash, the salt and the encrypted AES key AT THE SAME TIME. I am 99.9% sure that this is not a problem, but can it facilitate the work of an attacker being in possession of all those details?