title: Securely store a password in program code?
body: <p>My application makes use of the RijndaelManaged class to encrypt data.  As a part of this encryption, I use a SecureString object loaded with a password which get's get converted to a byte array and loaded into the RajindaelManaged object's Key at runtime.</p>
  
  <p>The question I have is the storage of this SecureString.  A user entered password can be entered at run-time, and that can be "securely" loaded into a SecureString object, but if no user entered password is given, then I need to default to something.</p>
  
  <p>So ultimately the quesiton comes down to:</p>
  
  <p>If I have to have some known string or byte array to load into a SecureString object each time my application runs, how do I do that?  The "encrypted" data ultimately gets decrypted by another application, so even if no user entered password is specified, I still need the data to be encrypted while it goes from one app to another.  This means I can't have the default password be random, because the other app wouldn't be able to properly decrypt it.</p>
  
  <p>One possible solution I'm thinking is to create a dll which only spits out a single passphrase, then I use that passphrase and run it through a couple of different hashing/reorganizing functions at runtime before I ultimately feed it into the secureString object.  Would this be secure enough?</p>
  
  <p>Edit For clarity*: The encrypted data is being passed via files between machines.  Think of it as a Zip file which always has a password, a default one is assumed if nothing is directly entered by the user.</p>