Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 with many rounds (taking 500ms on my Intel i5-3570).
I want to use the keychain (like available in Mac OS or some other pendant like keyring in Linux) to store the information needed to access the users data. My assumptions on the keychain are:
- The keychain is strongly encrypted and hence can be considered secure
- The keychain might be synchronized to the internet (like Apple allows to synchronize the keychain with iCloud)
I see two possible solutions:
- Store the users password in the keychain
- Derive the AES encryption key and store that in the keychain
My question is, which one is better both from the security standpoint and in general (if there is a general answer)? I guess solution 2 is better because of two reasons:
- The user password has not to be stored at all (even if the keychain is itself encrypted again, I find the user password deserves more protection than the derived AES key, since the user password might be used for some other accounts)
- Accessing the encrypted data is faster, since the slow task of deriving the AES key must only be done once
Is there anything I missed?