Storing passwords in a publicly available database I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them.

In the browser, when a user wants to add a password to the the config file:


User hash the password using bcrypt
User encrypts the hashed string with public key A
User adds the encrypted string to the config file and saves it to the database


A third party server will then connect to the database, this server knows the private key for A. This server verifies if some plaintext password match with the encrypted hash.
Other users see the config file, but they can't see what passwords are in it.

Some precision :


I don't care if another user edits the encrypted password, and I don't care who edits the password, so I don't think I need to sign anything.
It's really a public database, like a mysql instance without any security. 
I do the hashing on the client in case the private key gets stolen. It will take a long time to reverse the hash for all passwords.


It seems secure to me. Is it? Is there a simpler way?
It's generally not a good idea to store passwords of any kind in a database that's not secure, let alone a database that's intended to be publicly available.


  Is it secure?


If you don't care about tampering and wrong entries in the database then I guess this setup is okay.

Bcrypt already incorporates a salt to prevent rainbow attacks, so all passwords should have a different hash. Since you then encrypt the hash with the public key of an asymmetric encryption algorithm it should actually be secure. To try and brute-force a password in the database you would first have to brute-force the asymmetric encryption, which is infeasible on any time-scale.


  Is there a simpler way?


Yes, implement security-conventions (secure database, etc.), no need to reinvent the wheel.