My app needs to work with encrypted user files on their devices. It should keep the data secret when someone gets hold of the device. For this, I'm thinking about the following schema (which may be wrong, and that's why I'm asking).
- The app generates a random key
k(of a fixed predefined length), which will be used as a master key for the file encryption.
- It defines
K = k || o, with
obeing a string of zeros (of a fixed predefined length).
- It generates and stores a random salt.
- It computes
h(""), i.e., it applies a key derivation function to an empty string (which is the initial password; that's fine as the user will be prompted to change it before they store any data).
- It stores the
K ^ h("")in the key file (let's assume that the lengths match).
For validating a password, the content of the key file gets xored with
h(password) ^ h(""). The result must be
k || o, i.e., end with (at least) as many zeros as the length of
In order to change the password, the old password gets validated and when the check passes, the content of the key file gets xored with
h(oldPassword) ^ h(newPassword) and the key file gets overwritten by the result.
I wonder whether the xoring is sufficient. It's quite possible the whole schema is a mess, but I couldn't find anything appropriate.