Store hash password and encrypted data with this password in db? [migrated]
I'm currently developping a django application.
I need to store user data. This data must be unavailable to any other user
or admin
I've created a dedicated user account system (no using dj auth). (Maybe I
could modified it, but this is not the subject here..)
User password is hashed with passlib.
User data is encrypted using AES and user password (not hashed :p) as
secret key.
I'm wondering :
Is it safe to keep hashed password and encrypted data, when encryption
used this password as secret key ?
What can I do with AES IV used to crypt user data ? Generate it when I
create the user and keep it in user table, next to hashed password ?
No comments:
Post a Comment