I want to store some data so the only one who'll be able to access it is the user itself. Here is my idea: when user registers, his password will be hashed in
SHA256 (so it'll fit as an AES key), and encrypt the data using it as an
AES 256 key.
If so, I can give up the password section in the DB, I'll won't be needing to hash the password, make salt, etc - I can just try to decrypt the data - it it success, the password is correct.
So what considered to be more secure? One-way-hash using PHP's
password_hash with a strong salt, or just hash the password using
SHA256 and use it as an AES key (which won't be encrypting the password itself) ?
After all, I've read that AES 256 is secure enough to encrypt TOP SECRET info, so I'm pretty sure that it's hard to figure out what's the key. And even it they will somehow get hold on the key, they'll still have to brute-force the SHA256 to access the password.