Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm currently developping a django application.

I need to store user data. This data must be unavailable to any other user or admin

I've created a dedicated user account system (no using dj auth). (Maybe I could modified it, but this is not the subject here..)

User password is hashed with passlib.

User data is encrypted using AES and user password (not hashed :p) as secret key.

I'm wondering :

  • Is it safe to keep hashed password and encrypted data, when encryption used this password as secret key ?

  • What can I do with AES IV used to crypt user data ? Generate it when I create the user and keep it in user table, next to hashed password ?

share|improve this question

migrated from superuser.com Aug 25 '13 at 13:46

This question came from our site for computer enthusiasts and power users.

add comment

1 Answer

When hashing the password with passlib make sure to use passlib.hash.pbkdf2_sha512. You can read more on it here.

  1. Yes this is safe, in fact you actually need to do this to verify the password before trying to decrypt the data.
  2. The point of the IV is that even when the same key and plaintext is re-used, a different ciphertext will be produced. You can look at it a bit like a salt for a password. You just need to make sure it's unique and that when re-encrypting data (if data was modified) you generate a new IV.

Depending on the size of the data you can create a long, complex decryption key which is itself encrypted with AES using the user's password. This is often done as the user might decide to change his password. This would result in having to re-encrypt all data with the new password. Hence you use a decryption key which is itself encrypted with the user's password. In the event a user would decide to change his password, all you would need to do is re-encrypt the key. Now if you are just storing a bit of text this might be overkill, however, should you be storing large amounts of data (megabytes) then you could opt for this strategy.

share|improve this answer
    
Thanks. Understood that IV is a kind of salt. In my case, encrypted data is just an int (id column). So, can I store IV in the user table ? (next to hashed password, which, when cleared, is my AES secret key ?) –  Obscur Moirage Aug 25 '13 at 14:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.