I was wondering whether this encryption / decryption flow is very solid / secure. I encrypt the data using AES CBC 256 bit with an static IV.
When the user logs in with his Firebase account (first phase of authentication), he gets the option to enter a security password. After that is done, some encryption values will be retrieved like the prefix, suffix and IV. I create the key as following: prefix + given key + suffix. After that I decrypt a retrieved string, and if I get a certain text back, I know it is the right key and start decrypting it for this session.
So to sum it up:
- Log in with Firebase
- Get encryption values like prefix, suffix, IV and encrypted string
- Let user enter password
- Create an key in the format prefix + given password + suffix and apply an static IV
- Use the generated key to decrypt a string
- If it is successfully decrypted, use the key for this session
Note: I won't use public / private key exchange due to reasons.