We're currently looking into this subject matter, and this article was a big leap forward in our efforts:

HOW TO: Use the ASP.NET Utility to Encrypt Credentials and Session State Connection Strings