TL;DR: Is encrypting data with AES CBC with random IV + PBKDF2 key using the username as salt safe?
I have searched the internet, but I could not find a proper answer that encompasses the "AES CBC and random IV with PBKDF2 same salt" dilemma.
The scenario
I am developing a client/server/DB system, and my users need to have their data encrypted and accessible from multiple devices.
- Users log in with a username and password. The username and password hash (bcrypt) are saved to the database.
- Users create a series of items (user content) on their devices.
- Each item the user creates is encrypted with AES CBC and gets its random IV. Every item will use the same key generated via PBKDF2 with 310.000 iterations using the username as salt.
- Encrypted content is saved into the database along with IV (the key is not sent to DB, of course).
- Users can log in to another device and get content downloaded and decrypted using a (reverse) process as described in step 3.
Maybe it is relevant to understand that users will not share data. It is individual.
Why not different salts and, therefore, different keys?
I have tried using different salts and storing the salts along IV and the encrypted item, but using different salt in PBKDF2 for every item the user creates is painfully slow (given the 310k iterations). It is slow, mainly when the user downloads his 100s of items from DB. It was unacceptable.