The last three posts in this discussion thread discuss what you want.
Essentially, you overwrite the iBATIS connection string from the configuration file before calling Configure ().
For example, in your SqlMap.config:
<database>
<provider name="sqlServer2005" />
<dataSource name="TheDB" connectionString="${connectionString}"/>
</database>
And in your code where you are setting up the constructor, something like:
DomSqlMapBuilder builder;
string connection;
NameValueCollection properties;
connection = AccessTheEncryptedStringHere();
properties = new NameValueCollection();
properties.Add("connectionString", connection);
builder = new DomSqlMapBuilder();
builder.Properties = properties;
builder.Configure("SqlMap.config");