13

I am creating a web application with ASP.NET MVC, And I want to store some password into database.

The passwords must be recoverable. (They are not for myself, I need passwords to communicate with an API, which needs the real password) So I can't use hash algorithms or such.

I have found that AES is a good encryption algorithm for me.

But, the problem is: where to store AES key? Is storing in appsettings inside web.config enough? How to make the key harder to find (for hackers)?

And the next question: Any ideas to make this system safer?

4
  • Of course you can encrypt a key with another key, then encrypt that key with yet another key ad nauseum. But it pays off to think what you are trying to achieve, and that is to restrict access to information. There are oodles of method of accomplishing this, and most of them are not about encryption. Sep 14, 2012 at 18:08
  • So, What way do you recommend? Is storing the key in web.config and encrypting web.config enough? Sep 14, 2012 at 19:43
  • Yes, that could certainly be part of your key management scheme (hence the comment). I was just making sure you are not just looking at encryption mechanisms. Where are you going to the key that decrypts web.config? Who's got access to it? Sep 15, 2012 at 8:24
  • Currently, I'm storing the key of passwords in appsettings in web.config, and then encrypting web.config using the asp.net built in method. (See this: stackoverflow.com/questions/54200/… ), But I want to make this process safer. Sep 15, 2012 at 10:25

1 Answer 1

3

It is possible to encrypt sections of .config files. Here is the msdn documentation on the subject, although you will find other walkthroughs online as well.

1
  • Thanks, but do encrypting web.config makes enough security? How to make this system safer? Sep 13, 2012 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.