I'm working on a desktop application where we handle sensitive data and we want to encrypt local files with a password that we ask the user when he opens the application. On most similar project, we see that people store a hash of the password so they can verify that the password is valid before trying to decrypt everything. That exposes a security problem, because the hash can easily be extracted and brute-forced externally.
What we want to do is putting a static text at the beginning of the file to decrypt, And when the user enters the password, the application tries to decrypt that stamp and if it can, it would mean the password is valid and then he could proceed to decrypt the rest of the file.
Is it safe? Since I haven't seen this anywhere, I'm not sure if I overlooked something that could make this system vulnerable.
I wanted to revisit this question since I learned a lot about cryptography since then.
Obviously, the right answer is "Don't do it yourself, use a library for that made from someone that knows what they're doing."
Basically, the question was about how to verify if password was good before trying to decrypt an big file with it. The basic scheme I would recommend today for this is to generate a random key, use it to encrypt the file, and then key-wrap it using a key generated with a strong KDF(Like Argon2, Scrypt, BCrypt or PBKDF2) and an AEAD (like ChaCha20Poly1305, AES-GCM, or if you trust more recent algorithms you can use something like Deoxys-II or Ascon). This way, the password can be changed without re-encrypting the file and your code can check somewhat easily is the password is valid. This is somewhat similar to how KeePass and other password managers do, except they generally use a "regular" cipher + an HMAC instead of an AEAD.
TL; DR: Crypto is complicated, use a library.