(Originally posted to SOF, but I got no answers)
I am designing a small application for use inside my company. My application needs to connect to a third party website on behalf of my application user. I would like to safely store the user's credentials for the third party site in my database. Obviously, storing the third party password as plaintext is out of the question.
What I am proposing is the following:
- When a user creates an account in my application, the application generates two salt values.
- The user enters a new password for my site as well as credentials for the third party site (username and password).
- My application uses the first salt value and PBKDF2 or bcrypt to hash the user's local password. This hash is saved in the database for later authentication.
- My application uses the second salt value and the same key derivation function to generate a second hash. The second hash is used to AES-encrypt the third party credentials. The encrypted credentials are saved in the database for authenticating to the third party site.
The only weakness that I can find is that if the users' local password is weaker than the third party password, an attacker need only guess the local password and both are compromised.
Are there any other problems with the algorithm? Is there a better way to accomplish the same result?