How to generate two different keys out of a single password?

Question

I'm designing a system in which a password is used both for logging in as well as for encrypting some payload.

To encrypt a payload I derive a key from the password. Very straightforward so far.

Since that encryption should be end to end, the password is not sent to the server, but it is hashed first and then sent to the server. The server then re-hashes that password to store it in the database (for the same reason you hash a password).

It is paramount that the server cannot rebuild the password not the password-derived key that was used to encrypt the payload.

So, my question is about which algorithms to chose for each of these instances.

I'm pretty sure that to hash the password for authentication purposes I want to use Scrypt. I'm aware it hasn't been tested long enough but it seems to be offering the best security these days.

To derive the key from the password, my plan was to use PBKDF2. Reading about it, some people do recommend to use Scrypt instead of PBKDF2 as it's more resilient to GPU attacks. My problem with doing that is that if I use Scrypt for both, auth and key derivation, I could be exposing the key to the server (during authentication).

How should I resolve that problem other than by using two different algorithms?

For the record, for encryption I'm using AES, specifically, AES/GCM/NoPadding, although this is not set in stone.

My implementation is done in Java and currently I'm using Bouncy Castle.

Answer 1

My problem with doing that is that if I use Scrypt for both, auth and key derivation, I could be exposing the key to the server (during authentication).

If you use two hashes then one failing breaks whole system. Using one reduces chance of being broken than using two.

I'm pretty sure that to hash the password for authentication purposes I want to use Scrypt.

Scrypt isn't a hash, it is PBKDF. PBKDF2 is also a PBKDF, not a hash.

How should I resolve that problem other than by using two different algorithms?

First of all, don't use two different PBKDFs. Then you have two different attack vectors, and you spend less time per PBKDF than with one strong PBKDF.

You should derive master key first, using some PBKDF (I would recommend Argon2, making sure strong settings are used and using salt). After master key is derived you should use KDF (Key Derivation Function) to do exactly what you ask for: Make two keys from one. Then you have K1 and K2. K1 can be used for encryption and K2 can be sent to server which also should hash it(PBKDF is useless there).

You should also consider if server should store salt (+you can access your data after HDD fail; -Server can try to break your password).