From a similar questions I have a few options, but none is applicable in my case:
Tie the encryption key to your admin login
I don't trust the currently logged user. In fact, I want to hide this from anyone, but
Tie the encryption key to your hardware.
App1is deployed to thousands of machines, some may not have needed hardware.
Type in the encryption key when you start up, store it in memory.
User must not have access to
Store the key on a different server.
Machine is allowed to be off line, while
Store the key elsewhere on the same server.
Then it can be found.
Store the key in the database.
I need to secure the database, which is kind of recursive in my case.
Possible solution is to store the key using Windows DPAPI, but
DPAPI is focused on providing data protection >for users<.
Whereas I need to protect an application. I also need that
App1worked from different users on the same machine
I can add secondary entropy, to restrict the currently logged user from accessing the data.
However, I need to store this secret data on the machine. How do I protect that... Appears to be recursion again.
Question: where do I securely store application-specific symmetric key?