secure storage of sensitive data in J2EE

["chaim moshe" <xor256 () hotmail com>]

Hello list,

where can I  store sensitive data like encryption keys, passwords, etc. in 
J2EE?
surely, you can save it in the keystore, but the catch is where do you store 
the keystore password to protect it from external access?
storing the keystore password in code or in config files is not secured 
enough.


In the .NET environment you have DPAPI that was designed exactly for this 
kind of problem, the sensitive data is encrypted at the OS level with the 
user/machine password and is decrypted at runtime.
What is the solution in the J2EE environment ?

Thanks!

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/