1

I have an app that I store sensitive user data which requires user to set a password to login the app and I use this password as key to encrypt the data.

Now, I want to add an option to login the app with PIN. My problem is if user adds a PIN obviously I can't use it to decrypt the data. The only solution comes to my mind is to encrypt the password with PIN and store it locally. So when user enters the PIN, I can decrypt the password by using PIN then decrypt the data with this password.

  1. Is it secure?
  2. Is there another way to achieve this problem? Is it possible to encrypt the data such that I can decrypt it with password or PIN only?
ozkan
  • 11
  • 1
  • If you don't think the above is a duplicate, please [edit] your question to make clear how your situation differs. – otus Feb 17 '16 at 20:57
  • 2
    If your PIN is just a four-digit number, then an adversary can easily test all possible values. – r3mainer Feb 17 '16 at 20:59

0 Answers0