I want to clarify right off that bat that I am using the SSL/TLS protocol on top of this, so I am NOT trying to implement my own protocol to send data securely. I simply want the server to be unable to read user data.
I'm trying to implement a web application that stores sensitive data. I was thinking about using some public key derivation function to generate two keys from a master password, the first key is sent to the server for verification, and the second key is kept in the browser, and is used for symmetric encryption/decryption, like AES.
I really want to cover all my bases, so I just wanted to know if this method is still secure, and if it isn't, what I should do instead.