I'm not an expert and I would be very glad if someone could take a look at it and tell if there are any problems with it
Things I know/think are problematic
- using base64 digest + getting the first 32 char reduces key size, right?
- where should the salt be generated and stored
- should the encryption include some kind of counter
- should the aes IV be new each time the vault is encrypted?
Here are the diagrams of getting/setting the password file from and to the server: Blue values are input by the player in a prompt orange values are stored in a file on the client after authentication (not included in the diagrams)