A user downloads a file from a server. I want to store that file locally on the user's machine so they can view offline. For protection, it should be encrypted while not being viewed.
My theory is that you could generate a key to encrypt with using the user's password as input to a KDF so that the key can be created when the user wants to view the file without needing online access and we won't have to store a key locally somewhere.
I am concerned that this now presents an attacker with a possible offline attack to crack a user's password since they can try to generate keys until it decrypts the file. In a world where user's cannot be expected to use good enough passwords to generate strong keys, I suspect this method won't work well in practice.
Is this logic correct? Is there another way to handle this problem?