Storing NetworkCredential in SQL database

Question

I have a web project where I need to store a username and password in an SQL database. the username/password are for exchange web services.(so it cannot be hashed, I need to be able retrieve a clear text password) Each user of the web page will have to enter their username and password once and this is the information I want to store in SQL database, but in a way so its not possible to decrypt it for others then the user logged in to the web application (due to security concerns) I was thinking I could do this by using the users password for the web application to encrypt and decrypt the password. In this way you can only decrypt the exchange password if you know the users password for the web application. (which is hashed for this web application)

The web application is using forms authentication and the users has the option to "Remember me" so they don't have to sign in every time and here is the problem. I might not get a request with password for every new session. The exchange servers are out of our control, so we cannot use any impersonation, add users with special permission to mailboxes etc. The only thing we know about the exchange server is what we get through the exchange autodiscover service.

The only way I can think of is to create a hash representation of the users password and store it the authentication cookie. Then I can use this hash (plus some salt) to encrypt and decrypt the password for the exchange web services.

Is this a safe way to do it? is there any better way to solve this issue?

Answer 1

Not sure if there is a better way, but this is how I would do it. I think it is similar to what you describe in the question.

• Store the network credentials encrypted with a key that is derived from the users password, e.g. using PBKDF2). (If you also store password hashes for authentication, use a different salt so they are not identical.) That way, if your database is compromised the network credentials will still be relatively safe.
• To make the network credentials available without password reentry, I would encrypt them with a random key and store the encrypted value (but not the key) in a separate table. The key I would send as a cookie (with appropriate time out) to the user. That way, if your database is compromised the network credentials are still safe because the key is not there.
• Note that I would use a cryptographically secure random key, and not something related to the user, password or session ID.
• Remove entries from the table as soon as the session times out or a user loggs out.

The backside of this is off course that a user that can steal the cookie can decrypt the network credentials. But this will be a problem for any system where password reendry is not required - someone who could steal the session cookie would be able to appear as logged in anyway. So I think that is a drawback with not requiering password reentry, and not with this particular solution.

Disclaimar: This is not my area of expertece so you might want a second opinion on this.