I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.

I've used Rijndael as the algorithm of choice, but I'm struggling to find the correct approach to storing the encryption/decryption key, since an access database is inherently source-visible. How can I provide decent security on this one to prevent someone grabbing the database (by local access - this machine is NOT Internet connected) ? I feel I'm omst of the way there, but missing this vital piece of the jigsaw

  • $\begingroup$ You can't securely store the key without encrypting it itself (and having the password outside of the computer), or storing it in a file where only some specific user has the permissions to read it. If you want to know how to do this in your OS, this would be better in security.stackexchange.com. (You can flag your question for moderator attention and they will move it, if they agree.) $\endgroup$ Aug 7, 2011 at 0:55
  • $\begingroup$ Thanks - already raised manually now at security.stackexchange.com/q/5994/3862 $\endgroup$
    – Rob Cowell
    Aug 7, 2011 at 10:10

3 Answers 3


You can use a password based key, which is a similar approach to the PGP method, create a key somehow (random clicks, random numbers etc.), encrypt it with a password and store it somewhere. When the user wants to access the DB, he enters the password, which is the key for the DB decryption key file and then you get the clear password for the DB.

The main idea is to remove the key from the machine itself, and pass it to the user, and meanwhile generate a unique key for each user (computer), so if I have the SW on my computer, I still don't have the key to another's DB.

  • 2
    $\begingroup$ I would say that this answer shows that the question was not so off-topic. $\endgroup$
    – Arsen7
    Aug 8, 2011 at 8:25

The visibility of the source doesn't matter because it makes no sense to store the decryption keys there anyway. The answer lies with your operating system.

This question probably belongs on security.stackexchange.com.


To begin with, to reduce the risk of stealing the database, you may wish to store the encrypt/decrypt key elsewhere on the computer. A very simple solution would be to store it in the registry. A more complicated solution would be to use the CryptoAPI to store certificates elsewhere.

For future reference, you'll want to read about PCI-DSS, which are the industry standards for handling credit card information. One decent book on the subject is this one.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.