We are working on a tool that exports data from Source Application "S" to CSV files. These CSV files are manually migrated to box where the Target Application "T" resides. Each line in this CSV is encrypted. The sensitive data being migrated are passwords, password histories and challenge question-answers, etc.
We would be using the AES Encryption encrypt the user data. The question is should we generate a secret key for each user separately to encrypt/decrypt that specific user's data ?
If yes, how can we manage secret keys for thousands of users and in what form should we store them.
Other Easy alternative is to use one secret key for all the passwords and store this key in a JCEKS keystore.
Which would be a better and more secured approach ?