Encryption in asp.net

Well, with encryption you will always end up with this problem - what to do with the keys? Key storage and management is its own field.

Some approaches for you to evaluate:

• Use DPAPI to encrypt. With DPAPI Windows handles key storage under the credentials of the user your ASP.NET app runs as.

• If you are authenticating the user yourself using some secret (a password), you can derive the key from the password and a salt. Remember to re-encrypt the data if the user changes his password! The salt can be stored in cleartext alongside user information. You can derive a cryptographic key from a password doing something like this:

      public static KeyIV GetKeyBytesFromPassword(string password, byte[] salt) {
      using (var aes = new AesCryptoServiceProvider()) {
          using (var deriveBytes = new Rfc2898DeriveBytes(password, salt)) {
              var res = new KeyIV {
                  Key = deriveBytes.GetBytes(aes.KeySize / 8),
                  IV = deriveBytes.GetBytes(aes.BlockSize / 8)
              };
  
              return res;
          }
      }
  }
  

• If you really need top-notch security you can use a Hardware Security Module (HSM), which can be an independent piece of hardware (see for example Thales) or a board for your computer (see for example the IBM 4764 PCI-X Cryptographic Coprocessor or similar). In this case you are using specialized tamper proof hardware which will handle key storage and management for you.
• Some database products have what is called Transparent Data Encryption which basically will encrypt a whole database table for you transparently. It's very expensive though. Oracle and SQL Server both have it.

lot has been discussed here: What is the best way to encrypt SSNs in SQL Server 2008? .. I have encrypted password using RinadaelManaged and stored Key and IV along with encrypted password for description. The key and IV is different for every record.

http://msdn.microsoft.com/en-us/library/system.security.cryptography.rijndaelmanaged.aspx