I have a desktop application written in Python. The application is connects with an external SAP HANA service and pulls data. There are couple of configuration files where several connection string are stored unencrypted as of now.
I want to encrypt the config files which should get decrypted when user logs in. I checked few libraries like encrypted-config but my requirement doesn't fit here.
My plan is as below
- The configuration file is encrypted using an encryption Key:CK
- CK is stored on another server as encrypted with the user password HASH.
- When user logs into the application, password Hash is calculated and it connects to the key server, decrypt CK, store it in cache, decrypt the config file
- Pull data from SAP
I don't know how reliable is this approach but there are few challenges:
- If CK is encrypted with user password Hash, I need to keep multiple copies of CK for each user.
- I want to implement Key Rotation and in that case the problem 1 shared above will be even more tricky.
** Edited ** This Key Server is not specifically used for key management. I have just named another remote server as key server where the keys would either be stored encrypted in a database or a file.