I've handled a similar situation in the past through a combination of text/text area custom fields, apex and visualforce.
The text/textarea is used to store an encrypted version of the data. The visualforce page allows the user to type in the secret key that is used to view or save that data, and the apex controller actually carries out the encrypt before storing against the record and the decrypt when retrieving.
The reason I went that route is I didn't want every administrator to be able to access the plaintext data, which encrypted fields will allow. The downside is that if the secret key is forgotten or mislaid, its not possible to decrypt the data, so you need to make sure you have a process in place to manage the key.
The actual Apex is pretty straightforward. If these are being used in an automated fashion you could store the key in code, although this means it is still decryptable if someone goes to the effort of writing some additional apex to use the key.