I have an internal business application, that as part of its functionality connects to a third-party app using login credentials specific to the user of my own app. These passwords are stored in a central database. Currently they are plain text (this was justified based on a high level of front-line security into our corporate LAN), but a recent attack against the network of our new parent company (luckily they didn't actually get in) has led me to take another hard look at that.
Passwords for the main internal app, we can bcrypt them with a salt, no problems there. The problem is ciphering the third-party application credentials. As we all know, users like to keep the same password for multiple apps, so no matter what I do to the internal app password for safekeeping, it won't make a lick of difference if the third-party credentials are sitting there in plaintext right next to it.
Here's the kicker; whatever method is used, it must be reversible within the application, because the #$%^&* third-party app requires transmission of plaintext credentials from the internal app's process to a SOAP service (luckily it does so over HTTPS), and the internal application allows users to maintain these stored third-party credentials (saving the Dev department the trouble of maintaining DB content). So, the best I can do is encryption, not hashing.
So, I realize that any method I employ here will be less than ideal; if the attacker gets both the application and the credentials, he'll get the plaintext passwords and there isn't much I can think of to prevent it. I'm just trying to make an attacker work just that little bit harder to get the credentials, hopefully giving me enough time to at least alert the third party so they can disable our logins, if not force every user in the system to change their third-party credentials before the attacker can crack one.
So, what do you suggest? AES (I can't imagine RSA being of much use as the application has to both encrypt and decrypt)? Any clever tricks for keeping the key out of the hands of someone who manages to get both the DB and the application binaries?