how much is secure to encrypt a password using itself (as encryption key) for storing it on an insecure media? I want to store a password securely on a storage (suppose in a usual unencrypted file).

I use this password as AES key to encrypt itself (using AES-ECB) &amp; then store it on the media (the password length is at most 16 bytes).

When user wants to confirm it's identity, I decrypt this saved encrypted content with user input &amp; compare it with the same input, if they were equal it means that user has authenticated successfully.

Know I've two important questions:


Is it a CORRECT solution? If not, why not?
Is it the BEST solution? If not, why not? (and please give me the better suggestion)
I think what you are looking for is a Password-Based Key Derivation Function (PBKDF). 

You can take a moderately strong password, like 12-14 random letters and numbers (no dictionary words though!), and throw it into the PBKDF function together with some other parameters, e.g. salt, number of iterations and the desired key length.

After that you have a reasonably strong - say 128 bit key - for the real AES encryption/decryption.

For more info, see http://en.wikipedia.org/wiki/PBKDF2

One more thing. To prevent brute forcing of your key you should experiment with the number of iterations for the key derivation. As a good rule of thumb, choose a number that makes the algorithm run for approximately 1 second on the target machine.