I've created an algorithm I think I'm going to use for a cloud storage service I'm developing- if there are no issues or vulnerabilities with it. It's this along with TLS and forward secrecy implemented. Also when logging in on a new device you must confirm it through your email account.
To create account:
Generate two random keys, Key A and Key B. Key A is used to prove the identity of who is signing on. Key B is used to encrypt your files with AES-256.
Encrypt the two keys with AES-256 using a hash of the user's password. I'm going to post a separate question soon about intentionally creating a delay in the hashing function, to prevent brute force attacks.
Send the encrypted keys to the server, along with an SHA-256 hash of Key A.
Download the encrypted keys from the server.
Decrypt the keys with the hashed password.
Upload Key A to the server.
The server hashes Key A and compares it against the stored hash. If the two are identical, notify the client that the password is correct (not that it was sent over).
Delete the copy of Key A in memory from the server.
To make changes to files:
Log in using the steps shown above. The server will reject any actions unless logged in, obviously.
Encrypt all files with AES-256 using Key B (stored in memory on the client, never stored in plaintext on the server) before sending online. Decrypt all files offline accordingly.
To change the password:
Log in using the steps above.
Encrypt Key A and Key B (stored in memory after logging in) with the hash of the new password.
Instruct the server to delete the encrypted keys and upload the new ones.
To reset password and keys (in case of breach):
Log in. If you can not do so with the password and the steps above because your password was changed, use a recovery drive (optionally created when setting up a new account) with the keys stored on it.
Download all files from the server.
Decrypt the files with Key B.
Generate two new random keys, then encrypt the new keys with the new password and upload them, along with a hash of the new Key A.
The server caches the encrypted keys and hash, and sends a confirmation email to reset the account password and keys.
Once the confirmation email is accepted, the client begins encrypting the files with the new Key B and uploading them to the server. Once all files are completely transferred, the server removes the old files.
All keys are invalidated, signing out of the account on all other devices.
Please let me know if there are any problems with this algorithm or improvements I could make.