Either leverage AES or Encrypt modules or just have encryption functions in ldap_api. In the long run it would be nice to get encryption in core in more than just the way the password.inc is done in d7.