Important to know
Will not be passing the DEK from client to the server
The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be available publicly because of the use of public repositories
the encryption and hashing will be done on the client-side
Other than MITM attacks or somebody with access to the client machine what should I foresee?
Should I use a key other than the pass to generate the hash to remove single point of failure?
Any other suggestions?
Encryption of the data is not the biggest worry especially if users have private repos, but there is a concern for public repos, is there another way I could go about this?