I got a typical login setup: Username/password that is passed to server, hashed/salted with PBKDF2, then compared to hashed/salted entry in login database. After that, JWT token is generated and returned to client.
However, after login an AES-256 encrypted SQLite database file needs to be accessed for that user. I obviously don't want to use the stored login hash as the key, especially if they are in the same location because it might as well be plaintext. What if I stored a separate hash/salt operation on the password, then mixed it with a private key stored in a vault, and then used that as the key to open the SQLite file?
Am I making this too complicated? Or should I be pursuing a simpler solution and just putting everything in a vault?