I'm currently developping a django application.
I need to store user data. This data must be unavailable to any other user or admin
I've created a dedicated user account system (no using dj auth). (Maybe I could modified it, but this is not the subject here..)
User password is hashed with passlib.
User data is encrypted using AES and user password (not hashed :p) as secret key.
I'm wondering :
Is it safe to keep hashed password and encrypted data, when encryption used this password as secret key ?
What can I do with AES IV used to crypt user data ? Generate it when I create the user and keep it in user table, next to hashed password ?