User authentication + database encryption with same password

Question

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES encryption key from a more simple user password.

I also want to be able to tell the user if he is using the correct password when logging in. Speed is not an issue: the program will run on the user's device and not on a multi-user server.

So summarizing: I want to use one password both to encrypt data and authenticate users.

I can see two options for doing this:

1. Generate a SHA-256 hash from the scrypt output, store the hash in StoredHash and check if SHA256(scrypt("supplied password")) == StoredHash.

2. Encrypt the scrypt-output of the password using AES in EncryptedScryptOutput using the scrypt-output as the key and store that, and check if scrypt("supplied password") == AESdescrypt(decryptionKey = scrypt("supplied password"), EncryptedScryptOutput).

I (think I :-) am aware of the technical way this should be done, using salts and/or initial vectors. My questions are: Am I correct that both versions will be secure? Would you say that one option is better than the other, and why?

Thanks!

Answer 1

Both options are secure but the first is preferable.

Your first proposal is to use scrypt(password) as the encryption key and SHA256(scrypt(password)) as the password verifier. This is fine. Since it's computationally infeasible to calculate a SHA256 preimage it will not be possible for an attacker to calculate the encryption key from the password verifier.

Your second proposal is to use scrypt(password) as the encryption key and to use AES(scrypt(password), scrypt(password)) as the password verifier. Using a value as the key to encrypt itself is a form of hash, so this is equivalent to your first proposal except that you're using AES(x,x) to hash scrypt(password) instead of using SHA256. Since SHA256 is a proper hash function and AES(x,x) is not your first proposal is preferable.

Answer 2

As far as I can tell, your scheme is this:

• Compute scrypt(pass) and store it as the authentication key in your database.
• Compute sha256(scrypt(pass)) and use that as your data encryption key.

The problem with this technique is that an attacker with access to your database can simply compute the SHA256 hash of your scrypt hashes to gain the encryption keys.

A better solution would be to use a second scrypt hash as your data encryption key, with a surrogate key to facilitate easy password changes:

• Generate two salts (s1 and s2) and store them in plaintext.
• Generate a cryptographically secure random key k - this is our surrogate key.
• Compute scrypt(pass, s1) and store it as the authentication key in your database.
• Compute scrypt(pass, s2) and xor k with it. Store this value in your database.
• Use 'k' as your data encryption key.

When decrypting, you compute scrypt(pass, s2) and xor it with the stored key value to get the original value of k back.

This protects you against cases where the database is breached, and allows you to change passwords by computing the original value of k, then xoring that with scrypt hash of the new password and salt. Keep in mind that if a user forgets their password they will not be able to recover the data.