Storage of confidential data in a database, recommendations

Question

I am looking for the best solution to store sensitive data in a database. I know this is a common problem, and I did my homework (at least this is what I think), but I wanted to ask here before making a decision.

Assumptions:

• Encrypted data must be decrypted. We are talking about SMTP credentials such as username, password, host, itp port.

I was thinking about 2 concepts:

• Encrypt data using the passlib.totp library. To make this data more secure, I will store the key in a separate file. Then from what I see, I can use this library to decrypt data in plain text with my key.

• Another concept was to encrypt and decrypt the data during the request request using postgres:

  insert into demo(pw) values ( encrypt( 'data', 'key', 'aes') );
  

  and

  decrypt(pw, 'key', 'aes'), 'utf-8')
  

  Here the key will be stored in a separate file.

So my questions are:

• Which is better for encrypting / decrypting data, in code or in a database?
• Are there any better (stronger) libraries to use than passlib.totp -> I have no experience with this library (I know that encryption / decryption is not the most secure way to store a password -> a password that needs to be hased, but I need this in text form for use by smtp-gate users).

Answer 1

2) postgres: insert into demo (pw) values ​​(encrypt ('data', 'key', 'aes')); (pw, 'key', 'aes'), 'utf-8') .

, , pg_stat_activity, .. PostgreSQL , .

. , , . , , , - . - , in-db crypto, IMO, .

Answer 2

. , , ( ) , .

, , . , , " ", .

, -, . , , , , . , , , , . , , ", , ". , , , .

(.. , ), -, , . , . , , , , , , , . (: , , a) , , b) . , , , . , .)

tl; dr , . , , - , , , , , -, "" . , : .

Answer 3

Vault, :

. , Vault , , API ..

, , , .. , API. , Vault.

" ", , - . , , , , .

. REST API. - . .