I'm developing a web application for backups service. What's the best way to store SFTP/FTP credentials in the database? I guess they should be encrypted, then decrypted at runtime?
The ideal way to handle scenarios where you need a user's authorization would be to use something like Oauth, but given the fact that OAuth doesn't apply for SFTP, yes, you would want to store them in an encrypted format, and decrypted them at runtime. Encryption is incredibly hard to do correctly. Many experts who have done it for years still make mistakes. While I can't spell out specifically how your application should work, I can give some guidelines.
- Make sure you're following proper cryptographic protocols. This will be the hardest part. You will need to do some studying for this.
- Make sure to use a well-known library such as NaCl or BouncyCastle. They are nice, high-level libraries which make it harder to make mistakes.
- Choose the proper algorithm. You will want to choose a symmetric block cipher like AES-256. Asymmetric encryption or stream ciphers are not meant for the task which you are trying to accomplish.
- Store your encryption keys in a separate datastore from your encrypted data. If your database containing your ciphertexts is breached by a sql injection attack, you don't want the decryption key to be included along with that.
- Make sure you're accounting for people having duplicate passwords. Encryption is deterministic, meaning, if you use the same encryption key and the same plaintext, you will get the same output. This can be fixed in a couple of different ways: either using a unique encryption key for each client (probably not practical), making sure you use a unique IV (and choosing a mode of operation which supports IVs), or adding a unique value to the front of the plain text (again, making sure to choose the correct mode of operation.
This is not meant to be a be-all end-all list of how to implement the encryption securely, but it can at least get you pointed in the right direction.