Django encryption key integrity

Question

I am implementing a Django website in which uploaded files are encrypted with a user provided key before they are saved on the server (/media). When users wish to view them, they are prompted for the key, the encrypted file is decrypted, and then displayed for them. Here's my encrypt/decrypt file code:

from Crypto import Random 
from Crypto.Cipher import AES
from Crypto.Hash import SHA256


def encryption_pad(string):
    pad = b"\0" * (AES.block_size - len(string) % AES.block_size) 
    padded_string = string + pad
    return padded_string

def encrypt_file(key, file):
    with open(file, 'rb') as out:
        byte_output = out.read()

    hash = SHA256.new()
    hash.update(key)

    byte_output = encryption_pad(byte_output)       
    initialization_vector = Random.new().read(AES.block_size)
    cipher = AES.new(hash.digest(), AES.MODE_CBC, initialization_vector)
    encrypted_output = initialization_vector + cipher.encrypt(byte_output)

    with open(file + ".enc", 'wb') as out:
        out.write(encrypted_output) 

def decrypt_file(file, key):
    with open(file, 'rb') as input:
        ciphertext = input.read()

    hash = SHA256.new()
    hash.update(key)

    initialization_vector = ciphertext[:AES.block_size]
    cipher = AES.new(hash.digest(), AES.MODE_CBC, initialization_vector)
    decrypted_output = cipher.decrypt(ciphertext[AES.block_size:])
    decrypted_output = decrypted_output.rstrip(b"\0")

    with open(file[:-4], 'wb') as output:
        output.write(decrypted_output)

I am relatively new to security, so my question is: For this setup the keys must exist in the server's memory for some duration of time, so what is the proper way for my views.py function to pass them to this module and then properly dispose of them after?

Answer 1

There are some existing questions on how to securely handle (or not) in-memory objects in Python: see here and here.

If security is that important, though, you might want to consider an even more secure option: doing the encryption and decryption on the client, in Javascript. That way the key never gets sent over the wire, and never exists on the server. That's how LastPass works, for example.