How to store information like passwords encrypted but not in hash

Question

I need to store "password like information" in a database field. I would like it to be encrypted but I need to decrypt it before using it. So I can not use a Hash/Salt solution.
Granted if an attacker made it that far into the database it may be too far gone but I figure this would at least stop the mistaken dump of the data.

1. How to encrypt a value store it into the database and decrypt the same value for use later?

2. Hashing is not an option (I use it on other parts actually).

3. Where to store the private key? Users would not supply anything.

This a C# solution so .NET specific stuff would be great. My question is very similar but I am looking for a .net based solution: Two-way encryption: I need to store passwords that can be retrieved

EDIT: Hogan pretty much answered my question. I found examples out there and they ranged from very complicated to rather simple. It looks like AES is still good so I will be using that method. thank you for all your help.

Answer 1

One solution that does not involve private keys is using DPAPI.

You can use it from .NET via the ProtectedData class.

Here is an example:

public void Test()
{
    var password = "somepassword";

    var encrypted_password = EncryptPassword(password);

    var decrypted_password = DecryptPassword(encrypted_password);
}

public string EncryptPassword(string password)
{
    var data = Encoding.UTF8.GetBytes(password);

    var encrypted_data = ProtectedData.Protect(data, null, DataProtectionScope.CurrentUser);

    return Convert.ToBase64String(encrypted_data);
}

public string DecryptPassword(string encrypted_password)
{
    var encrypted_data = Convert.FromBase64String(encrypted_password);

    var data = ProtectedData.Unprotect(encrypted_data, null, DataProtectionScope.CurrentUser);

    return Encoding.UTF8.GetString(data);
}

Please note that DPAPI in this case depends on the current logged in user account. If you encrypt the password when your application is running as User1, then you can only decrypt the password running under the same user account. Please note that if you change the windows password for User1 in an incorrect way, then you will lose the ability to decrypt the password. See this question for details.

If you don't want use DPAPI, and prefer to have a private key. Then the best place to store such private key is in the user's key store. However, in order to store a private key in the local user store, you need to have a certificate for it. You can create a self signed certificate and store it with its corresponding private key into the local user certificate store.

You can access the user store in code using the X509Store class. You can use it to find the certificate (which is in C# a X509Certificate2 class) that you want to use and then use it to do encryption/decryption.

See this and this for more details.