2 comparable hashes generated from one string Assume a website where people log in with their password.

The password is now stored in sql database as:

md5(password + random_salt)


We are adding the possibility for clients to stay logged in and I am trying to find out the best way to do that.


Passwords should stay stored in the DB as hashes using some hash function (with the use of a generated salt) - first hash
When client logs in with his password, a different hash of his password should be generated (using the previously generated salt) and stored in the relation "second hash".
These two hashes should be comparable to each other, so that I could check if the second hash (generated during login) originates from the same string as the first one (generated during registration).


The second hash (the "login" one) would also be used to generate a key to encrypted sensitive user files (probably using AES, or is there a better option?).

I am quite new to this and I'm not sure if I am not being too naive, so I am asking. Is there a way to achieve this? Is there any source where I could read about these "comparable hashes"? I tried searching but I don't really know what to look for.
Deriving an encryption key and a password hash from a single password
Hash the password, along with a per-account salt.
hash1 = SHA256(password, salt)

hash1 is your encryption passphrase that you pass to GPG.
hash2 = SHA256(hash1)

You keep hash2 in your database to figure out when a user has logged in correctly.
(For additional security, change the first SHA256 out for scrypt, tuned for 50 milliseconds. More trouble than it's worth, IMO.)
Encrypting a file
Use a library like GnuPG. If you don't have GnuPG bindings for your language (I'm guessing you're using PHP), you can hack something together by running gpg from your program with the  -c and --passphrase arguments.
Note that if the user changes their password, you need to decrypt and re-encrypt using the new password.