I am developing a web application which stores encrypted data on a server. I want to derive the encryption key as well as the login key from a single user password, so I want to use libsodiums crypto_pwhash to generate a long enough key, that I can split in two. The idea is that the server cannot decrypt the encrypted data.
To use this function it needs a salt. I understand that the salt may not be secret, but it must be stored somewhere.
If I store it in the server, it must be retrieved before authentication (because it is needed to derive the login key). So this would allow for testing if a username exists without knowing its login key. I am unsure if that would be a security risk.
Could I derive the salt some other way? What if I would just hash the username? Or the password itself? Or would I run into the risk of not having enough entropy?