WebApp Sec mailing list archives
Re: secure storage of sensitive data in J2EE
From: Valdis.Kletnieks () vt edu
Date: Tue, 25 Jan 2005 11:41:13 -0500
On Tue, 25 Jan 2005 09:18:15 GMT, chaim moshe said:
where can I store sensitive data like encryption keys, passwords, etc. in J2EE? surely, you can save it in the keystore, but the catch is where do you store the keystore password to protect it from external access? storing the keystore password in code or in config files is not secured enough.
So when you start up, you put up a dialog box and prompt for the password. This is hardly rocket science - Apache has had the *exact* same issue with starting an SSL-enabled webserver from day one. http://www.modssl.org/docs/2.8/ssl_reference.html#ToC2 http://www.modssl.org/docs/2.8/ssl_faq.html#startup http://www.modssl.org/docs/2.8/ssl_faq.html#remove-passphrase Same issues, even though it's OpenSSL rather than J2EE. You have to measure the tradeoffs of various security choices and take the route that sounds the best for your specific application. Basically, which worries you more - the cert being stealable if the machine is compromised, or the machine not restarting without human intervention in case of a problem?
Attachment:
_bin
Description:
Current thread:
- secure storage of sensitive data in J2EE chaim moshe (Jan 27)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Jan 27)
- RE: secure storage of sensitive data in J2EE Erez Metula (Jan 30)
- RE: secure storage of sensitive data in J2EE Alexander Klimov (Feb 02)
- RE: secure storage of sensitive data in J2EE Jaime Spicciati (Feb 02)
- RE: secure storage of sensitive data in J2EE Erez Metula (Jan 30)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Jan 27)
- Re: secure storage of sensitive data in J2EE Sean Radford (Jan 27)
- Re: secure storage of sensitive data in J2EE Steve Taylor (Jan 27)
- Re: secure storage of sensitive data in J2EE Kevin Conaway (Feb 07)
- Re: secure storage of sensitive data in J2EE Dimitris Mistriotis (Feb 07)
- Re: secure storage of sensitive data in J2EE Antoine Martin (Feb 07)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Feb 07)
- Re: secure storage of sensitive data in J2EE Ashish Popli (Feb 09)
- Re: secure storage of sensitive data in J2EE Kevin Conaway (Feb 09)
- Re: secure storage of sensitive data in J2EE [Virus Checked] graham . coles (Feb 09)
- Re: secure storage of sensitive data in J2EE Richard Moore (Feb 09)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Jan 27)