I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement.
So far, I have come up with the following process:
- User supplies password or key file.
Then, per file that is to be encrypted:
- Password/key file from (1 above) is hashed via SHA256 once.
- The result from SHA256 is base91-encoded and sent through scrypt (N=2^15, r=8, p=1) with a randomized 16-byte salt to derive a 32-Bit key for AES-GCM.
- The file is encrypted and authenticated using AES-GCM with the key from (2) using a randomized 96-bit nonce as iv.
- Scrypt-values (N, r, p, and salt) and the AES-GCM nonce (=iv) get stored (unencrypted) in the file header for decryption.
The program does make sure it doesn't process files larger than 2^39 - 256 Bits (size limit for AES-GCM encryption from NIST 800-38D).
Is this design flawed in any serious way?