I want to generate an encryption key for the user to encrypt their data locally before sending to the server. The server should not have any knowledge, nor be able to compute, this encryption key.
This encryption key should be deterministic, so that regardless of which device they're on, the same key is generated and stored locally.
This makes their password an ideal choice to generate a key from.
At first I thought, easy:
Given user inputted password uip:
encryption_key (ek) = sha256(uip); password_sent_to_server (pw) = sha224(uip);
This way, the server can never know or receive the user's inputted password, and cannot compute the encryption_key.
However, after asking this question, I've been told to use a key derivation function instead.
The problem is, I'll now need two random salts to generate ek and pw. And these salts cannot be stored on the server. So that means I'll also need to generate two deterministic salts based on either the user's email or password.
What's the right way to go about doing this?
This answer recommends using the email as the salt. So perhaps:
ek = pbkdf2(uip, email, 1) pw = pbkdf2(uip, sha256(email), 2)
(The sha256(email) for the second salt is questionable. Was just trying to get at a different non-random salt for the second one.)
This answer recommends using pbkdf2 to generate a 512 bit key and splitting it:
output = pbkdf2(uip, email, 1, 512); ek = firstHalf(output); pw = secondHalf(output);
Am I interpreting these answers correctly? Any commentary on either approaches?