User Name and Password in Config file

[probashi]

I need to store username and password in my windows application
app.config file, from my application I am communicating to an external
system (CICS).

I believe, one of my options is to encrypt this in config file and
decrypt this inside my application using SymmetricAlgorithm
(System.Security.Cryptography).

My question is where should I store the key for encryption and
decryption. My application needs to know this for decryption and the
operation guys need to know this for encrypting user/pass (when there
is changes ).

I would like know the best practice regarding this.

 

[Brendan Green]

I'd look at using the Enterprise Library Cryptography Application Block and
Configuration Application Block. Makes for a very easy way to encrypt
configuration files, and handles the storage of keys.

Checkout :
http://msdn.microsoft.com/library/?url=/library/en-us/dnpag2/html/EntLib2.asp