My app must read an SSL url from a third party. How do I best store the third party credentials in my own database, which protects the third party credentials from being compromised? Consider both absolute security and practicality. One-way hashing the credentials is not useful as I must restore credentials to plaintext for the SSL call. I'm using python on google app engine, and my app authenticates with google credentials.

* encrypt credentials using e.g. AES and save the encryption key somewhere else (just moves the problem), or [derive it from the credentials and keep the algorithm secret](https://stackoverflow.com/questions/1819023/encrypting-3rd-party-credentials/1822022#1822022) (just moves the problem)
* encrypt credentials using a [synchronous stream cipher](http://en.wikipedia.org/wiki/Stream_cipher#Synchronous_stream_ciphers), derive the (not)entropy from the credentials and [keep the algorithm secret](http://en.wikipedia.org/wiki/Pseudo-random_function) (just moves the problem)
* on a separate web app dedicated to storing third party credentials, provide a SSL url to receive the third party credentials, this url is accessed with google credentials (same as my app) and can use authsub or something to transfer authorization to the other web app. this sounds more secure because its harder to hack a trivially simple webapp, and if my complex main app gets compromised the third party credentials aren't exposed.

what do you think about all approaches?