I came up with a user-details-storing procedure that was, in the beginning, based on actual security-literature – but then I just kept writing without really doing all the cross-checking I should have been doing.
Username, password and personal details are entered.
A random 128-bit symmetric key is generated.
Two random initialization-vectors are generated.
The array in which the personal details (name, email etc) are stored is AES-128 encrypted using the freshly generated key and the first initialization vector.
The symmetric key itself is then encrypted with AES-128 – using the user's password plain-text password as the key and the second initialization-vector.
The newly encrypted key, initialization vector 1 & 2 and the encrypted array of personal details are stored in an object which is then serialized into a file under an ID – a hash of the user's username.
When program retrieves the details – it hashes the current user's username, looks up that hash in the "users" file (the ID), retrieves the object associated with it, decrypts the key and the uses the decrypted key to decrypt the user-data.
Is it grotesquely insecure? Am I missing something obvious?