Re: secure storage of sensitive data in J2EE

[Steve Taylor <stillio () bellsouth net>]

You have several choices.  You can store these in a JNDI directory with 
the proper security realm and JAAS controls, or you could store it in a 
backend database or ldap of some form.  The idea is to not store these 
locally to the server/app they are intended to protect, such that if 
your code or the server is compromised there is no further loss.

chaim moshe wrote:

> Hello list,
>
> where can I  store sensitive data like encryption keys, passwords, 
> etc. in J2EE?
> surely, you can save it in the keystore, but the catch is where do you 
> store the keystore password to protect it from external access?
> storing the keystore password in code or in config files is not 
> secured enough.
>
>
> In the .NET environment you have DPAPI that was designed exactly for 
> this kind of problem, the sensitive data is encrypted at the OS level 
> with the user/machine password and is decrypted at runtime.
> What is the solution in the J2EE environment ?
>
> Thanks!
>
> _________________________________________________________________
> Express yourself instantly with MSN Messenger! Download today it's 
> FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/