I am creating a web application with ASP.NET MVC, And I want to store some password into database.
The passwords must be recoverable. (They are not for myself, I need passwords to communicate with an API, which needs the real password) So I can't use hash algorithms or such.
I have found that AES
is a good encryption algorithm for me.
But, the problem is: where to store AES key? Is storing in appsettings
inside web.config
enough? How to make the key harder to find (for hackers)?
And the next question: Any ideas to make this system safer?
web.config
? Who's got access to it?appsettings
in web.config, and then encrypting web.config using the asp.net built in method. (See this: stackoverflow.com/questions/54200/… ), But I want to make this process safer.