I' writing tool, which manage our application.

To store passwords in encrypted view - I made class which based on two posts:

http://stackoverflow.com/questions/20852664/python-pycrypto-encrypt-decrypt-text-files-with-aes

and:

http://stackoverflow.com/questions/4102761/python-config-parser-cache-to-reduce-i-o-on-an-embedded-system

#!/usr/bin/env python import os import StringIO import hashlib from Crypto import Random from Crypto.Cipher import AES from lib.shared import ConfigParser class RDSCryptor(object): def __init__(self, rdsmanager_local_path): password = 'password' self.key = hashlib.sha256(password).digest() self.passfile_enc = os.path.join(rdsmanager_local_path, 'conf', 'credentials.txt.enc') self.passfile_clear = os.path.join(rdsmanager_local_path, 'conf', 'credentials.txt') def pad(self, s): return s + b"\0" * (AES.block_size - len(s) % AES.block_size) def encrypt(self, message): message = self.pad(message) iv = Random.new().read(AES.block_size) cipher = AES.new(self.key, AES.MODE_CBC, iv) return iv + cipher.encrypt(message) def decrypt(self, ciphertext): iv = ciphertext[:AES.block_size] cipher = AES.new(self.key, AES.MODE_CBC, iv) plaintext = cipher.decrypt(ciphertext[AES.block_size:]) return plaintext.rstrip(b"\0") def encrypt_file(self): with open(self.passfile_enc, 'rb') as fo: plaintext = fo.read() enc = self.encrypt(plaintext) with open(self.passfile_enc + '.enc', 'wb') as fo: fo.write(enc) def decrypt_file(self): with open(self.passfile_enc, 'rb') as fo: ciphertext = fo.read() dec = self.decrypt(ciphertext) return dec def get_credentials(self, section, option): buf = StringIO.StringIO(self.decrypt_file()) config = ConfigParser.ConfigParser() config.readfp(buf) return config.get(section, option) 

Cleartext file (it's doesn't stored in projectэы repository) looks like:

[cloudlibrary] clc_user = username clc_password = password [kantar_smtp] smtpconnect_user = username smtpconnect_password = password 

Thet - this class used in main tool's script with:

... # Cloudlibrary access data crypto = RDSCryptor(rdsmanager_local_path) clc_user = crypto.get_credentials('cloudlibrary', 'clc_user') clc_password = crypto.get_credentials('cloudlibrary', 'clc_password') # Sendmail credentials smtpconnect_user = crypto.get_credentials('kantar_smtp', 'smtpconnect_user') smtpconnect_password = crypto.get_credentials('kantar_smtp', 'smtpconnect_password') ... 

All I want is to hide plaintext from source code - it's not intended to be super-secure against hackers.

What wrong or can be done better here?