What is a secure way of storing an a username and password (not asp.net membership details) within a database table that needs to be pulled out and decrypted to use for passing to a webservice.
Each way I think about the problem I find security holes as the username and password need to be in plain text before being passed to the webservice.
Can't you use the webservice method to unencrypt them and pass in the encrypted string from the database?
Some suggestions:
For storing the data
Passing to the web service
As Fermin says, Do you have access / control over the web service on the other end.
if so, you should send the details encryped. However, even if you send an username and password pair encryped. someone could still sniff them and have a valid pair of UN and PW.
HTTPS would help in this situation.
There is no 100% secure way of sending sensitive data over the wire. Its a case of doing the best you can.
T-SQL supports a number of cryptographic functions that could be used to encrypt the data (e.g. via instead of triggers, if client not already using stored procs).
Doing the encryption in the database engine should be a last resort, far better it were done earlier in the chain.
There was an article a few years back in MSDN magazine that covered the usage of these functions.
IMHO is that you never unencript data...
Use a 1 way encrytion to encrypt the data before you first save it, use this on password and user name.
When the user logs on you encrpt the username and password and then check that the encrypted values match on the DB. I.e you do not need to unencrpt.
Because its one way encryption is very hard to decrpy (some say its just takes to long to make it worth hacking) thats why is one way...
MS encrypto class offers 1 way encryption.
hope this helps
Jules