I have some secure data created in my client app which I wish to store on the server as backup for the user.
The user already has a password to authenticate with the server. The password is never sent to the server (I use SRP6 to authenticate the user).
So here is my thinking...
- Use Fortuna PRNG with multiple event inputs (mouse, keyboard etc) to generate a salt.
- Use salt and password as inputs to either Scrypt or PBKDF2+SHA512 with 40,000+ iterations to generate a 512-bit key.
- Use the first 256 bits of the key to encrypt the private data using AES-256-CBC with random IV.
- Send the ciphertext and salt to the server.
- Show the user the KDF iteration count as a number they need to memorize. We will ask for it when we need to decrypt the data client-side later on.
So my question is...is this secure enough? Initially I was going to store the iteration count server-side too but felt that an attacker who gained access to the server might then be able to easily brute force the key. Then again, whether users will be able to remember a password and a number is another question.