Re: Password management

I have a client that has some unusual needs about passwords.

The scenario, as best I can describe it, is something like this:
A physically secure domain server
Hundreds of client machines, including laptops

The basic idea, and I can't go into the reasons because of NDA, is
A client will contact the server and ask for an account password
A client will then use that password to call LogonUserW or
similar API requiring a password

This means that at the point of the call of the LogonUserW API, the
password must be in
plaintext. During the transmittal from the server, it is heavily
encrypted. The goal is
to extract the password from the Windows password database, convert it to
plaintext,
encrypt it, send it down, decrypt it, and use it.

Yes, they are aware of vulnerability issues during the brief plaintext
time, and for
reasons I cannot discuss, that is under control.

The problem is how to get the password decrypted back into plaintext from
the Windows
password database. There are lots of articles explaining how to set up to
use reversible
password encryption.

While there is a lot of talk about reversible password encryption, there
is no discussion
of the algorithms or APIs required to actually do this. Anyone have any
ideas? google
search and MSDN search are not turning up anything usable.

Any pointers would be appreciated.
thanks
joe
Joseph M. Newcomer [MVP]
email: newcomer@flounder.com
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm