I would like to know how to store a sensitive file; a credential of sorts. I want to password-protect it, obviously. It would be appropriate - in my application - to prompt the user for the password each run. There are proper apps - like SSH - that password-protect private keys and so on, and that's the model and best-practice I'd like to follow.
What is the best-practice for encrypting small files? I'm thinking of generating a random key to encrypt the file with and using a block cipher. And then encrypting this random key with the user's password, and trying to salt and stretch that password.
In the same way that storing password hashes is something you should turn to a proper 'stretching' function like bcrypt/scrypt/PBKDF2 (ideally via a library like Python's passlib) rather than rolling your own, are there proper algorithms and libraries for password-protecting files?