I'll quickly outline the purpose of our application:
The user logs in using his username and password. He will receive a list of servers he can connect to. After choosing a server the connection to this server is established.
Some more details about the application that complicate our requirements:
- One user can have multiple devices
- Server lists can be shared amongst multiple users
What's the best way to store the server passwords on our application server?
Ideas that we already played with:
- Symmetic encryption using the user's password as key
- Won't work with shared list
- Would need to store the user's password on the client if don't want him to log in every time he's using the application
- Symmetic encryption using the user's password hash (bcrypt) as key
- Won't work with shared list
- If an attacker has access to the server he will be able to decrypt the server passwords using the user's password hash, that is also stored in the database
- Using bcrypt to securely store the passwords
- Won't work as we will need the plain password to connect
- Storing the passwords in plain text
- C'mon...
Any ideas are more than welcome.