Made register and login actually work and go through. It uses Libsodium for cryptography. The way it works is it derives a key from the password using Argon2id and then derives 2 subkeys using KDF. 1 of the keys is used to seed a signature key (ed25519). The public key is shared with the server when one registers. When one wants to log in, they do the same process: ask the server for a challenge, sign the challenge, and send it back to the server. The server uses this to verify one’s password without having to send the password to the server. The other KDF subkey is then used to decrypt the master key, and the master key is used to decrypt the encryption and signature keys that will be used for email sending.

This solution is not the greatest, because if the database gets leaked, it is possible to do an offline attack by computing the KDF subkeys for random passwords and see if any of them give a public key that’s in the database.