WebApp Sec mailing list archives
Re: secure storage of sensitive data in J2EE
From: Dimitris Mistriotis <besieger () yahoo com>
Date: Mon, 7 Feb 2005 16:10:05 -0800 (PST)
I'm not 100% sure but it has to do with how java garbage collector handles this. If it is a string in Java, which are immutable, when you "write" junk into it, JVM will simply intorduce a new string leaving previous one in memory until garbage collector finds it and remove it (something that might take enough time for it to be read). So you can use StringBuffer objects but you have to assure that there is not a string conversion involved anywhere :( --- Kevin Conaway <kevin.conaway () gmail com> wrote:
A followup question: Once the data (be it a password or a key) has been read into memory, what is an effective and secure way of minimizing the window that the plaintext key or password is in memory? If the data is read into a char [] and then overwritten with junk data, would that work? Kevin On Tue, 25 Jan 2005 09:18:15 +0000, chaim moshe <xor256 () hotmail com> wrote:Hello list, where can I store sensitive data like encryptionkeys, passwords, etc. inJ2EE? surely, you can save it in the keystore, but thecatch is where do you storethe keystore password to protect it from externalaccess?storing the keystore password in code or in configfiles is not securedenough. In the .NET environment you have DPAPI that wasdesigned exactly for thiskind of problem, the sensitive data is encryptedat the OS level with theuser/machine password and is decrypted at runtime. What is the solution in the J2EE environment ? Thanks!
_________________________________________________________________
Express yourself instantly with MSN Messenger!Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
===== Dimitrios Mistriotis __________________________________ Do you Yahoo!? Read only the mail you want - Yahoo! Mail SpamGuard. http://promotions.yahoo.com/new_mail
Current thread:
- secure storage of sensitive data in J2EE chaim moshe (Jan 27)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Jan 27)
- RE: secure storage of sensitive data in J2EE Erez Metula (Jan 30)
- RE: secure storage of sensitive data in J2EE Alexander Klimov (Feb 02)
- RE: secure storage of sensitive data in J2EE Jaime Spicciati (Feb 02)
- RE: secure storage of sensitive data in J2EE Erez Metula (Jan 30)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Jan 27)
- Re: secure storage of sensitive data in J2EE Sean Radford (Jan 27)
- Re: secure storage of sensitive data in J2EE Steve Taylor (Jan 27)
- Re: secure storage of sensitive data in J2EE Kevin Conaway (Feb 07)
- Re: secure storage of sensitive data in J2EE Dimitris Mistriotis (Feb 07)
- Re: secure storage of sensitive data in J2EE Antoine Martin (Feb 07)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Feb 07)
- Re: secure storage of sensitive data in J2EE Ashish Popli (Feb 09)
- Re: secure storage of sensitive data in J2EE Kevin Conaway (Feb 09)
- Re: secure storage of sensitive data in J2EE [Virus Checked] graham . coles (Feb 09)
- Re: secure storage of sensitive data in J2EE Richard Moore (Feb 09)
- Re: secure storage of sensitive data in J2EE Nick Seward (Feb 09)
- Re: secure storage of sensitive data in J2EE Randy (Feb 09)
- Re: secure storage of sensitive data in J2EE Nick Seward (Feb 09)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Feb 10)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Jan 27)