Crypto is hard. Thank you for helping me learn.
My encryption scheme currently looks like this:
- Salt is stored out in the open
- Secret is the user's password, known only to them
- EncKey||AuthKey = PBKDF2(Secret, Salt, n) where n = lots
- My encrypted payload consists of IV||Ciphertext||HMAC
- IV = secure random bytes, unique to each payload
- Ciphertext = AES-256 CBC(EncKey, IV, Plaintext)
- HMAC = HMAC-SHA1(AuthKey, IV||Ciphertext)
Now, I want to change Secret. As it stands, this will make all of my already encrypted data unreadable. So, I want to keep the same EncKey.
Will the following be a secure scheme?
- EncKey||AuthKey = secure random bytes, chosen once ever
- PwdEncKey||PwdAuthKey = PBKDF2(Secret, Salt, n)
- EncKey and AuthKey are encrypted as above, but using the PwdEncKey and PwdAuthKey
- Everything else is encrypted and signed with EncKey and AuthKey
To rotate my password, I can then decrypt the payload which has EncKey and AuthKey (which now never change) and re-encrypt it with the newly derived PwdEncKey and PwdAuthKey.
Does it weaken my security having EncKey and AuthKey stored in an encrypted blob alongside the data which they are encrypting? Is there a smarter way to do this?