Consider Argon2i used as a key derivation function (implemented by the libsodium crypto library) to derive an encryption key from a password.
Additionally, when entering the password a second time, it should be checked for validity, meaning whether the same encryption key was derived as for the first time.
A possible approach would be:
During key generation:
- Derive a 256-bit key from the initial password using Argon2i
- Invoke Argon2i a second time using the output of the first "round" as its input
- Save the result of the second "round" to persistent storage
- Use the result of the first round for encryption
During key regeneration / verification:
- Perform steps 1./2. above for the re-entered password
- Check the result of the second round against what was previously saved to persistent storage
- Use the result of the first round for decryption
Is this approach "safe" when for each invocation of Argon2i the same parameters, but different salts are used? Could there be unintended side effects when chaining Argon2i invocations together? Is it safe to assume that it is impossible to compute the result of the first round given only the result of the second round and all salts? Can the approach be safely extended to use even more rounds?