I'm new to the whole cryptography thing and I want to implement it in my app to store non-personal user data. I've been trying to get my head around the whole thing by reading articles and questions etc.
I want to encrypt some non-personal user data related to my app. It is only the single user that should ever be able to decrypt data on their own devices so the server or anyone else should never be able to read the data. As I'm using third party auth providers I don't have access to users password hashes so my current plan was as follows:
- Random number key - When the user signs up create a random number using a CSPRNG to use as the key to encrypt user data.
- Recovery key - Generate a recovery key (6 digit code for example) and hash it using PBKDF2 or Argon2 and then encrypt the random number key using the hash output and store this key in the database.
- Storing the recovery key - Store the recovery key on the user's device in secure encrypted storage such as keychain for iOS and keystore for Android
- Decrypting data - Whenever we need to decrypt data we can pull the key from the database with the encrypted data and use the recovery key stored securely on the users device to decrypt the data.
- Resetting the recovery key - if a user wants to reset a recovery key we can simply decrypt the encryption key and then repeat step 2.
Does this encryption method seem safe to use for this purpose?
Is this symmetric or asymmetric as there are two keys involved with the encryption process meaning only the user with the key on their device can decrypt?