I don't understand why I need a salt for Argon2 if Argon2 is only needed as a KDF for a password which is then called AES. At the end neither the password nor a password hash is stored. Only the data which was encrypted with the KDF key. It is logical that when storing passwords in databases a salt is needed to prevent rainbow table attacks. It is also logical that a hard coded salt is bad. But why can't the user password itself be used as salt in case Argon2 is used as KDF? (Of course this salt would not be stored with the encrypted data ;) ) Maybe I misunderstood the concept of salt... This gives me a good overview but it can't answer my question directly...
Here is the background: I am creating an app where some user data is stored in a CouchDB database. This data should be encrypted locally, as well as in the database. For the prototype, we use symmetric encryption. The procedure is as follows:
- The user enters a password.
- the KDF (Argon2id) generates an encryption key from the password and a random salt.
- Using AES-256 GCM, the data set is encrypted with the key and transferred to the cloud.
- on another device the data is downloaded and salt, IV and data are separated.
- Argon2id is then called up again with the salt, the key is generated, and the data is decrypted with it.
The problem: with an increasing number of files, the number of calls to the KDF increases and the performance suffers drastically. A single salt would make this much easier.