I am working on a project that uses a combination of a web based framework (Django) and an installed app (Python) for the purpose of data entry/upload. I will have to send medical records over the web and I've been trying to come up with a way to make a system that is cryptographically sound. I figure I can use django's
auth_user table which contains usernames and hashed and salted passwords. The default format for this field is
If I have password and the salt, I can recreate the hashed password which I want to use as the key for AES. The problem is that the salt is randomly created by django during password creation.
My question is, would it create any insecurities to send the salt along with the encrypted information?
I'm thinking that it would not because the salt is assumed to be known by an attacker anyway.
Side question: Is AES considered secure for medical information? Are there any pitfalls I should be aware of?