🚀 go-pugleaf

Hi,

my program needs to encrypt some data and
save it in an options file (user, password etc).

In my first version I used an XOr algorithm
and had the key hard-coded in my exe-file.

For the next version I would rather use a
more secure method. I'm trying to use CryptoApi
with an RC2 algorithm. As documented I derive
the key for the algorithm from a password. The problem
is, again, that I have this password hard-coded.
I do this because the session keys are not persisted
between sessions. Using the password I can recreate
the same key. But this isn't more secure than my
original approach.

I now read that each key container for a user has
two private/public key pairs. Can I use those keys
to encrypt/decrypt my data?
The docs state that one in general uses session keys to
encrypt data because symmetric algorithms are about 1000
times faster. But since my amount of data is small
it wouldn't be a problem for me to use a private/public-key
algorithm.

So, is there a common strategy to handle this?

thanks for any idea,
Nick