storing SSNs, CCNs, password in the DB

["Francesco" <francesco () blackcoil com>]

What is the most secure way to store SSNs, CCNs, and passwords in the
DB?

Is this a good general policy?

1. If you need to be able to read the data back, the encrypt/decrypt
with something like TDES, storing the keys in the registry.

2. If you don't need to read the data back and you just need to compare,
then hash/salt with SHA1, storing the hash and salt in the DB.

Francesco