存储AES密钥的位置？

Question

I am creating a web application with ASP.NET MVC, And I want to store some password into database.

The passwords must be recoverable. (They are not for myself, I need passwords to communicate with an API, which needs the real password) So I can't use hash algorithms or such.

I have found that AES is a good encryption algorithm for me.

But, the problem is: where to store AES key? Is storing in appsettings inside web.config enough? How to make the key harder to find (for hackers)?

And the next question: Any ideas to make this system safer?

Answer 1

It is possible to encrypt sections of .config files. Here is the msdn documentation on the subject, although you will find other walkthroughs online as well.