Under what circumstance would someone be able to uncover the DB password but not the DB decryption key? Since they're both required at connect time, you would probably store them in similar places at the application level. Have you considered doing encryption/decryption at the application level instead?
Jon Emerson
http://www.jonemerson.net/