I don't want the password to be sent in clear text over the internet, even when using HTTPS the server admin can read the password if they somehow cache or log post requests.
Now, what I have come up with is the following.
First, generate a "salt" from the user email and extend it with padding like this:
var email = "example@example.com"
const padding = 0x12564213155763573 (this is constant for all users)
var extended = email.padEnd(100, padding) //appending the padding at the end of the email and maximum string length is 100
var salt = sha256(extended)
Then calculate a hash of the password using PBKDF2 like this:
var password = pbkdf2("user password", salt, 10000, 128)
The hashed password will be the actual password of the user, and it will be sent to the server and the server will calculate another hash of that hash.
I'm posting this here because I came up with this on my own and I feel like something is missing or wrong here, as they say about cryptography you shouldn't invent it yourself.
Are there any flaws in this system?
Note: The user password is used to encrypt user private data that should be only decrypted by that user.
