Security Basics: Re: Encryption Key Question

[Zaven <zaven () sonic net>]

David Heise wrote:

> Here's my question:
> What is the best method of storing this passphrase internally in the
> application such that it would be as secure as possible?
AFAIK, you can't store the passphrase anywhere securely. You should 
think in terms of requiring the user/other process/whatever to input the 
passphrase in to authenticate, and then storing only the hash digest.
If anyone knows how (e.g., Apple Keychain Manager) manages to diaplat 
the plaintext of stored passwords, I'd like to know, because it makes me 
nervous :)
Zaven