Per User Encryption

Hi,



I'm trying to determine what the best way to do what basically amounts to per user encryption is.



I want to provide the ability for my users to store their passwords (to various applications, and possibly product keys, but the content is mostly irrelevant) in a retrievable format, but I want this information encrypted at rest. I'm not new to cryptography but am fairly new to encryption in sql server.



My issue arises from not seeing how I can manage (creating) the keys for the different users in a fairly automatic fashion.



The closest I've come to what I'd consider to be 'workable' is having the user 'request' access at which point they'd be asked for a password to create their master key. That master key would be used for protecting individual keys for each of the stored items. If so desired it could then continue the key chain to allow users to share specific items. Sadly I don't have the infrastructure for a CA, otherwise I'd go that route as theoretically that should 'just work' if I can assign people certs.



Ideally I'd be assigning users to an active directory security group, which would be part of an 'allowed to use the password tool' server role with appropriate permissions, and the client would authenticate (or be impersonated) through to the database with their pre-existing windows credentials, and everything else would just be magic.



Back on topic, I'm mostly looking for a way to handle this initial key creation (i.e. without a user 'requesting access' and having to create their master key w/password through an interface or support request). I expect I'll have to write an interface for the end user to manage their individual keys and "sharing" regardless of the route I take, so adding a way for them to create the initial key isn't a concern, I'm just worried I may have missed something and will be reinventing the wheel here.



Is there built in functionality I can/should look at regarding this? Or does anyone have a better way to do what I want to?




Thanks for your help.