Hash password with bcrypt before encrypting document with openpgp

Question

Hi all first time posting thanks for putting together this great community.

I'm working on an extension to allow users to store encrypted documents on a server I host. I'd like to avoid having them re-enter their password each time they want to encrypt or decrypt a document, but I'm also hoping to avoid having to hold onto their password, even if just in memory.

For logging in, my thought process for this is to hash the password on the client with bcrypt and send that to the server. On the server I'll hash the input from the client and store both the client's and server's salts.

For encryption, I'll hash the password on the client again with bcrypt and a different salt (I'll also store this salt on the server so the user can regenerate the hash). I'll then generate a key pair with openPGP for encrypting the document. I'll encrypt the private key with a symmetric key generated from the password hash and I'll store the encrypted private key, encrypted document, and public key on my server.

My question is if there's any concern in using a hash as an input to openpgp or in generating two different hashes from the same password using two different salts.

Answer 1

I'll then generate a key pair with openPGP for encrypting the document. I'll encrypt the private key with a symmetric key generated from the password hash and I'll store the encrypted private key, encrypted document, and public key on my server.

Edit: I don't see a cryptographic weakness in this, however it seems very complicated for what you are trying to achieve. I'd suggest that you write down your exact requirements and then look for the most simple way in which your infrastructure and cryptography can fulfill them.

For example, I don't see a particular reason to use asymmetric encryption here (besides it being ridiculously slow compared to symmetric encryption).

any concern [...] in generating two different hashes from the same password using two different salts.

No. Salt just "extends" the original data to make it harder for an attacker to use rainbow tables once they get your database. To my knowledge there is no attack, which allows (or makes easier) breaking the hash, if two hashes with different salts are provided.