I have an Android app that internally relies on a SQLite database that stores encrypted user data. The data is encrypted using AES-256, with a key generated by the PBKDF2-HMACSHA256 algorithm. The application has the need to detect manipulation of the data either by malicious or non-malicious methods (i.e. data corruption or someone purposely tampering with the database).
As far as I can tell I have two solid options on how to securely generate a hash to represent this data. Either, I can rely on a HMAC-SHA256 algorithm keyed with the same password used to generate the AES-256 key to generate signatures of the data in each row of the database. Alternatively, I could generate an ordinary SHA-256 hash of the decrypted data stored in memory before re-encrypting it to update the database row. So in theory, only the authenticated user with the correct key can decrypt the data and therefore only that user can generate this "signature".
Here is my question: To use HMAC-SHA256 will cause complications with exactly how to securely persist the password as the key or some way to leverage the SHA-256 key as the HMAC key. Either way, it seems un-necessarily painful and complexity is in general, bad new for secure systems. Would it be equally secure to rely on a ordinary SHA-256 hash of decrypted data as it would be to use a HMAC style hash algorithm? As in, are they equally difficult/impossible to forge a signature.