WebApp Sec mailing list archives
Re: secure storage of sensitive data in J2EE [Virus Checked]
From: graham.coles () retail-logic com
Date: Wed, 9 Feb 2005 17:09:36 +0000
That doesn't necessarily work anyway; the JVM can always disregard it - note the phrasing in the api for System.gc(): "Calling the gc method suggests that the Java Virtual Machine expend effort toward recycling unused objects" runFinalization() similarly only "suggests" it calls the finalize method of collected objects, the JVM may still decide it's not worth doing at the time. However, if the key is held in an array and you've already overwritten it, why bother - the contents have already been destroyed and collection will gain you nothing. If you've used a string for some reason, you should recode it using an array rather than praying to the garbage collector and hoping it doesn't ignore you ... Kevin Conaway <kevin.conaway@gm To: apopli () gmail com ail.com> cc: webappsec () securityfocus com, secprog () securityfocus com Subject: Re: secure storage of sensitive data in J2EE [Virus Checked] 09/02/2005 14:36 Please respond to Kevin Conaway Forcing the garbage collector to run in Java is considered bad practice On Tue, 08 Feb 2005 22:49:30 -0500, Ashish Popli <apopli () gmail com> wrote:
Cant we simply force garbage collection when you are done using the
object?
Here is a link. http://java.sun.com/docs/books/tutorial/essential/system/garbage.html Kevin Conaway wrote:A followup question: Once the data (be it a password or a key) has been read into memory, what is an effective and secure way of minimizing the window that the plaintext key or password is in memory? If the data is read into a char [] and then overwritten with junk data, would that work? Kevin On Tue, 25 Jan 2005 09:18:15 +0000, chaim moshe <xor256 () hotmail com>
wrote:
Hello list, where can I store sensitive data like encryption keys, passwords, etc.
in
J2EE? surely, you can save it in the keystore, but the catch is where do you
store
the keystore password to protect it from external access? storing the keystore password in code or in config files is not secured enough. In the .NET environment you have DPAPI that was designed exactly for
this
kind of problem, the sensitive data is encrypted at the OS level with
the
user/machine password and is decrypted at runtime. What is the solution in the J2EE environment ? Thanks! _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's
FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
Current thread:
- RE: secure storage of sensitive data in J2EE, (continued)
- RE: secure storage of sensitive data in J2EE Jaime Spicciati (Feb 02)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Jan 27)
- Re: secure storage of sensitive data in J2EE Sean Radford (Jan 27)
- Re: secure storage of sensitive data in J2EE Steve Taylor (Jan 27)
- Re: secure storage of sensitive data in J2EE Kevin Conaway (Feb 07)
- Re: secure storage of sensitive data in J2EE Dimitris Mistriotis (Feb 07)
- Re: secure storage of sensitive data in J2EE Antoine Martin (Feb 07)
- Re: secure storage of sensitive data in J2EE Valdis . Kletnieks (Feb 07)
- Re: secure storage of sensitive data in J2EE Ashish Popli (Feb 09)
- Re: secure storage of sensitive data in J2EE Kevin Conaway (Feb 09)
- Re: secure storage of sensitive data in J2EE [Virus Checked] graham . coles (Feb 09)
- Re: secure storage of sensitive data in J2EE Richard Moore (Feb 09)
- Re: secure storage of sensitive data in J2EE Nick Seward (Feb 09)
- Re: secure storage of sensitive data in J2EE Randy (Feb 09)
- Re: secure storage of sensitive data in J2EE Nick Seward (Feb 09)
- Re: secure storage of sensitive data in J2EE Alexander Klimov (Feb 10)