RE: secure storage of sensitive data in J2EE

["Jaime Spicciati" <spicciati_jaime () bah com>]

The best solution I have found is to store the connection
strings/usernames/passwords in an encrypted file. The key for the encrypted
file will of course be stored in a keystore. But how do you access the
keystore without storing the password for the keystore in a plain text file?
Obviously you cant store it in some other location such as an LDAP or
another database because again, you are going to need a
username/password/connection to connect to the storage media, really its a
chicken and egg problem.

The best approach is to create an initialization page in the case of a web
application. So when the J2EE server is started it is
inoperable/uninitialized until the initialization page is accessed. This
initialization page will take a password from the Administrator and in turn
will unlock the keystore to get the key to decrypt the
username/password/connection  information and configure the DB connections
for transactions. This approach takes the keystore password off the file
system and puts it into the administrators head.

Jaime Spicciati
Booz Allen Hamilton
Information Assurance

-----Original Message-----
From: Erez Metula [mailto:erez () avnet co il]
Sent: Monday, January 31, 2005 2:00 AM
To: secprog () securityfocus com; webappsec () securityfocus com
Subject: RE: secure storage of sensitive data in J2EE



I think that the issue here is sensitive information stored on the server
side like connection strings, encryption keys and such. You can't ask the
user to enter a password for this kind of information.
Storing this information in a file in cleartext, won't protect this
information from someone who has access to the server, for example a
legitimate (malicious) admin user  or  a hacker who had managed to break
into the system.



----------------------------------------------------------------------------
--------------------------------------

Erez Metula
Application Security Consultant
Avnet Data Security       Mobile: 972-54-8179538    Office: 972-3-9560074
(Ext. 126)



-----Original Message-----
From: Alexander Klimov [mailto:alserkli () inbox ru]
Sent: Tuesday, January 25, 2005 6:33 PM
To: chaim moshe
Cc: webappsec () securityfocus com; secprog () securityfocus com
Subject: Re: secure storage of sensitive data in J2EE

On Tue, 25 Jan 2005, chaim moshe wrote:
> where can I store sensitive data like encryption keys, passwords,
> etc. in J2EE? surely, you can save it in the keystore, but the catch
> is where do you store the keystore password to protect it from
> external access? storing the keystore password in code or in config
> files is not secured enough.
Well, there is no way to make the following things simultaneously
without additional input for legitimate user:
-- a legitimate user is able to recover information
-- an attacker is unable to recover information

> In the .NET environment you have DPAPI that was designed exactly for this
> kind of problem, the sensitive data is encrypted at the OS level with the
> user/machine password and is decrypted at runtime.
This is a solution: the legitimate user needs to enter password which
is cached by the system. I really doubt that J2EE can have similiar
things since many OSes do not cache user passwords.

> What is the solution in the J2EE environment ?
You can ask the user to enter the password. An alternative solution is
to use non-owner-read-protected files.

--
Regards,
ASK


This Mail Was Scanned By Avnet Secure System


****************************************************************************
********
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer
viruses.
****************************************************************************
********