I am working on an E2E encrypted app. I am using OpenPGP.js and storing public and private keys on the server. The private key is encrypted with a BIP39 passphrase which is stored in browser LocalStorage so it's never sent to a server. But I also need some credentials for users to login.
My idea is to make SHA256 from BIP39 passphrase and split it to two strings. First can be used for "username" and the second for server password.
Is this approach safe? As far I know it should be. BIP39 passphrase has entropy big enough. I can't use salt because that BIP39 passphrase should be the only secret to store.
Is this approach valid? Thank you.