WebApp Sec mailing list archives
Re: secure storage of sensitive data in J2EE
From: Valdis.Kletnieks () vt edu
Date: Mon, 07 Feb 2005 21:13:50 -0500
On Tue, 08 Feb 2005 00:36:41 GMT, Antoine Martin said:
On Mon, 2005-02-07 at 14:41 -0500, Kevin Conaway wrote:A followup question: Once the data (be it a password or a key) has been read into memory, what is an effective and secure way of minimizing the window that the plaintext key or password is in memory? If the data is read into a char [] and then overwritten with junk data, would that work?Not if your buffer gets swapped out beforehand, but the window of opportunity remains short.
If you are on a system where you can use mlock(), that can help minimize the swapped-out-buffer issue. Not sure if you can get at mlock() from the J2EE environment, though....
Attachment:
_bin
Description:
Current thread:
- Re: secure storage of sensitive data in J2EE, (continued)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Jan 27)
- RE: secure storage of sensitive data in J2EE Erez Metula (Jan 30)
- RE: secure storage of sensitive data in J2EE Alexander Klimov (Feb 02)
- RE: secure storage of sensitive data in J2EE Jaime Spicciati (Feb 02)
- RE: secure storage of sensitive data in J2EE Erez Metula (Jan 30)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Jan 27)
- Re: secure storage of sensitive data in J2EE Sean Radford (Jan 27)
- Re: secure storage of sensitive data in J2EE Steve Taylor (Jan 27)
- Re: secure storage of sensitive data in J2EE Kevin Conaway (Feb 07)
- Re: secure storage of sensitive data in J2EE Dimitris Mistriotis (Feb 07)
- Re: secure storage of sensitive data in J2EE Antoine Martin (Feb 07)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Feb 07)
- Re: secure storage of sensitive data in J2EE Ashish Popli (Feb 09)
- Re: secure storage of sensitive data in J2EE Kevin Conaway (Feb 09)
- Re: secure storage of sensitive data in J2EE [Virus Checked] graham . coles (Feb 09)
- Re: secure storage of sensitive data in J2EE Richard Moore (Feb 09)
- Re: secure storage of sensitive data in J2EE Nick Seward (Feb 09)
- Re: secure storage of sensitive data in J2EE Randy (Feb 09)
- Re: secure storage of sensitive data in J2EE Nick Seward (Feb 09)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Feb 10)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Jan 27)