WebApp Sec mailing list archives
Re: secure storage of sensitive data in J2EE
From: Alexander Klimov <alserkli () inbox ru>
Date: Tue, 25 Jan 2005 18:33:07 +0200 (IST)
On Tue, 25 Jan 2005, chaim moshe wrote:
where can I store sensitive data like encryption keys, passwords, etc. in J2EE? surely, you can save it in the keystore, but the catch is where do you store the keystore password to protect it from external access? storing the keystore password in code or in config files is not secured enough.
Well, there is no way to make the following things simultaneously without additional input for legitimate user: -- a legitimate user is able to recover information -- an attacker is unable to recover information
In the .NET environment you have DPAPI that was designed exactly for this kind of problem, the sensitive data is encrypted at the OS level with the user/machine password and is decrypted at runtime.
This is a solution: the legitimate user needs to enter password which is cached by the system. I really doubt that J2EE can have similiar things since many OSes do not cache user passwords.
What is the solution in the J2EE environment ?
You can ask the user to enter the password. An alternative solution is to use non-owner-read-protected files. -- Regards, ASK
Current thread:
- secure storage of sensitive data in J2EE chaim moshe (Jan 27)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Jan 27)
- RE: secure storage of sensitive data in J2EE Erez Metula (Jan 30)
- RE: secure storage of sensitive data in J2EE Alexander Klimov (Feb 02)
- RE: secure storage of sensitive data in J2EE Jaime Spicciati (Feb 02)
- RE: secure storage of sensitive data in J2EE Erez Metula (Jan 30)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Jan 27)
- Re: secure storage of sensitive data in J2EE Sean Radford (Jan 27)
- Re: secure storage of sensitive data in J2EE Steve Taylor (Jan 27)
- Re: secure storage of sensitive data in J2EE Kevin Conaway (Feb 07)
- Re: secure storage of sensitive data in J2EE Dimitris Mistriotis (Feb 07)
- Re: secure storage of sensitive data in J2EE Antoine Martin (Feb 07)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Feb 07)
(Thread continues...)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Jan 27)