StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POStoring passwords that can't be hashed in a server application
text
Body
copied!<p>I have a .NET server application that must store passwords that can't be hashed because some APIs I use need the passwords in plain text.</p> <p>These passwords can also be exported and imported as part of the system configuration into another server instance of the application or for backup purposes. </p> <p>The encrypted data will definitely need to be readable by application instances on other servers besides the one it was exported from.</p> <p>What is the most secure way to accomplish this without too much hassle for the user and minimum risk of data loss because of a lost/unavailable encryption key?</p> <hr> <p><strong>EDIT</strong></p> <p>I am looking more for details like:</p> <ul> <li>How/where to store the key </li> <li>Generating a unique key for each install and storing it vs an application wide common key</li> </ul> <p>...not on which encryption algorithm to use.</p> <hr> <p><strong>EDIT II</strong></p> <p>I should add that this application will be distributed to customers to run on their own servers. It is a client/server application. The passwords stored are only used by our application to pass into external API methods. We don't use them for anything else.</p> <p>The main concern is when the system configuration is exported as XML for backup or to move to a different machine. This is where we want to protect them, but also make it as easy and flexible for the user as possible.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload