Re: secure storage of sensitive data in J2EE

[exon <exon () home se>]

Michael Silk wrote:
> Exon said:
>
> > Because it's supposed to be encrypted when it arrives over 
> > the network. 
>
>
> And how can that happen in such a way that an application listening to
> the incoming information can't get at it first?

It can't, but protecting pieces of memory from prying eyes was what this 
discussion was about. If the key to decrypt the incoming message is 
stored in a secure manner (and deleted securely once the transaction is 
over), there is no way the eavesdropper can read it (always assuming the 
encryption algorithm is sound). This is more or less why encryption was 
invented, in case anyone hasn't done their homework. If you take 
encryption out of the mix there's no way to protect the data.

/exon