I've gone through the below question:
And read the below articles about how to encrypt files using
But didn't get my answer. Instead of the file assume that I have text for encryption so I do as below:
from Crypto.Cipher import AES import hashlib password = 'A_VERY_STRONG_RANDOM_PASSWORD' key = hashlib.sha256(password).digest() IV = ''.join(chr(random.randint(0, 0xFF)) for i in range(16)) mode = AES.MODE_CBC encryptor = AES.new(key, mode, IV=IV) text = 'j' * 64 + 'i' * 128 ciphertext = encryptor.encrypt(text)
Users of the system has hundreds of files and they all need to be encrypted at rest, so I want to use AES as its encryption is fast and secure.
The first question is that do I need to generate a new password everytime I want to encrypt a file? Or should it be per user? or system wide? Which one is the best practice and more secure?
The second question is that where should I store these/this password(s)?
NOTE: I don't want to use
HSM or any external hardware for this.