Architectural Breakdown & AnalysisFAANG Aligned
Protecting user credentials and sensitive PII data requires multiple layers of cryptographic defense.
1. Password Hashing (Argon2id / bcrypt)
Never store plaintext passwords or plain MD5/SHA256 hashes. Use salted, adaptive memory-hard algorithms like Argon2id or bcrypt with a work factor $\ge 12$ to prevent GPU brute-force attacks.
2. Envelope Encryption for PII Data
- Data Encryption Key (DEK): Encrypts sensitive database column data locally.
- Key Encryption Key (KEK): Stored securely in HSM / AWS KMS to encrypt the DEK.
python
# Hashing passwords securely
import bcrypt
hashed_password = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt(rounds=12))WARNING — Secret Management Anti-Pattern
Never hardcode secrets in Git repositories. Use secret managers like HashiCorp Vault or AWS Secrets Manager.
Key Architectural Comparison
| Data Category | Cryptographic Standard | Key Management | Salt / Nonce Requirement |
|---|---|---|---|
| User Passwords | Adaptive Slow Hashing (Argon2id / bcrypt) | Irreversible one-way hash | Unique random salt per password (prevents Rainbow Tables). |
| PII & Card Numbers | Authenticated Encryption (AES-256 GCM) | AWS KMS / HashiCorp Vault | Unique 96-bit Initialization Vector (IV) per record. |
| API Keys & Tokens | High-Speed Digest (HMAC-SHA256) | Secret signature key | Salted token prefix. |