I'm building an application with the following requirements:
- A client logs in with email and password. On the server,
bcrypt(password)
is computed and compared to what is stored in the database. - If authentication is successful, the server sends a block of encrypted data that will later be decrypted on the client. (At some point in the past, the data was encrypted by the client and sent to the server.)
- The password for the encrypted data must never be sent to the server, so I can't use the same password for authentication and encryption/decryption.
One solution that would fulfill these requirements is to just use two passwords: one for authentication and one for encryption/decryption of the data. However, users will need to remember two passwords and could mix them up, accidentally sending the decryption password to the server and violating the third requirement.
An alternative that requires only one password: use the password for encryption/decryption and bcrypt(password)
for authentication. That way, the database would store bcrypt(bcrypt(password))
and the server would never handle the encryption/decryption password.
Is that a reasonable thing to do or am I overlooking a security issue? The additional computation/login time caused by computing two hashes wouldn't be a problem.