In my web application I need to store some (very) sensitive data for my users. This data only needs to be available to the end user for the duration of the active session. The users log into the web application using username/password with 2FA.
I'm thinking about encrypting this data using user's password as the key. When the user logs in to the site, if the password is correct, I can then decrypt the data using this password as the key and store it in the session.
While theoretically this may be an OK solution, I still feel that this may not be very secure. Additionally, strong encryption algorithms like aes-128-cbc or aes-128-gcm require an initialisation vector, which would need to be stored to enable decryption - and I don't have an answer to this just yet.
So, is this approach reasonable or is there a better solution to this?