Luciano,
When storing session keys in Linux, the same main principles apply. The
best thing is not to store the session keys at all, but to derive them
by using for example PBKDF2 (Password-based key derivation function 2),
specified in PKCS #5. However, when you really need to store key
material, you should password protect it, using PBKD2 to generate a key
from a password and then use that key to encrypt the key material.
Furthermore, you should use an encryption scheme that provides both
encryption and message integrity, to make sure the key file has not been
modified. For an excellent encryption scheme, take a look at Brian
Gladman's implementation of CWC.
Regards,
Daniel Susid
-----Ursprungligt meddelande-----
Från: Luciano R. de Albuquerque [mailto:aluciano@ravel.ufrj.br]
Skickat: den 25 januari 2005 19:25
Till: secprog@securityfocus.com
Ämne: Re: secure storage of sensitive data in J2EE
I have a similar question to this sent by Chain.
But, instead of java I m using C. So, which kind of solution do you
sugest to
store session keys in a linux enviromnent using C.
regards,
Luciano.
Citando chaim moshe <xor256@hotmail.com>:
Hello list,
where can I store sensitive data like encryption keys, passwords,
etc. in
J2EE?
surely, you can save it in the keystore, but the catch is where do you
store
the keystore password to protect it from external access?
storing the keystore password in code or in config files is not
secured
enough.
In the .NET environment you have DPAPI that was designed exactly for
this
kind of problem, the sensitive data is encrypted at the OS level with
the
user/machine password and is decrypted at runtime.
What is the solution in the J2EE environment ?
Thanks!
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's
FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
Luciano R. de Albuquerque
Mestrando - COPPE/Sistemas - UFRJ
Lab. de Redes de Alta Velocidade - RAVEL
http://www.ravel.ufrj.br
http://www.ravel.ufrj.br/~aluciano
http://www.garf.coppe.ufrj.br/
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
