I'm designing a system in which a password is used both for logging in as well as for encrypting some payload.
To encrypt a payload I derive a key from the password. Very straightforward so far.
Since that encryption should be end to end, the password is not sent to the server, but it is hashed first and then sent to the server. The server then re-hashes that password to store it in the database (for the same reason you hash a password).
It is paramount that the server cannot rebuild the password not the password-derived key that was used to encrypt the payload.
So, my question is about which algorithms to chose for each of these instances.
I'm pretty sure that to hash the password for authentication purposes I want to use Scrypt. I'm aware it hasn't been tested long enough but it seems to be offering the best security these days.
To derive the key from the password, my plan was to use PBKDF2. Reading about it, some people do recommend to use Scrypt instead of PBKDF2 as it's more resilient to GPU attacks. My problem with doing that is that if I use Scrypt for both, auth and key derivation, I could be exposing the key to the server (during authentication).
How should I resolve that problem other than by using two different algorithms?
For the record, for encryption I'm using AES, specifically, AES/GCM/NoPadding, although this is not set in stone.
My implementation is done in Java and currently I'm using Bouncy Castle.