I have an app that I store sensitive user data which requires user to set a password to login the app and I use this password as key to encrypt the data.
Now, I want to add an option to login the app with PIN. My problem is if user adds a PIN obviously I can't use it to decrypt the data. The only solution comes to my mind is to encrypt the password with PIN and store it locally. So when user enters the PIN, I can decrypt the password by using PIN then decrypt the data with this password.
- Is it secure?
- Is there another way to achieve this problem? Is it possible to encrypt the data such that I can decrypt it with password or PIN only?