SV: secure storage of sensitive data in J2EE

Luciano, 

When storing session keys in Linux, the same main principles apply. The
best thing is not to store the session keys at all, but to derive them
by using for example PBKDF2 (Password-based key derivation function 2),
specified in PKCS #5. However, when you really need to store key
material, you should password protect it, using PBKD2 to generate a key
from a password and then use that key to encrypt the key material.
Furthermore, you should use an encryption scheme that provides both
encryption and message integrity, to make sure the key file has not been
modified. For an excellent encryption scheme, take a look at Brian
Gladman's implementation of CWC.

Regards,
Daniel Susid

-----Ursprungligt meddelande-----
Från: Luciano R. de Albuquerque [mailto:[email protected]] 
Skickat: den 25 januari 2005 19:25
Till: [email protected]
Ämne: Re: secure storage of sensitive data in J2EE

I have a similar question to this sent by Chain.
But, instead of java I m using C. So, which kind of solution do you
sugest to
store session keys in a linux enviromnent using C.

regards,
Luciano.

Citando chaim moshe <[email protected]>:

> Hello list,
>
> where can I  store sensitive data like encryption keys, passwords,
etc. in
> J2EE?
> surely, you can save it in the keystore, but the catch is where do you
store
> the keystore password to protect it from external access?
> storing the keystore password in code or in config files is not
secured
> enough.
>
>
> In the .NET environment you have DPAPI that was designed exactly for
this
> kind of problem, the sensitive data is encrypted at the OS level with
the
> user/machine password and is decrypted at runtime.
> What is the solution in the J2EE environment ?
>
> Thanks!
>
> _________________________________________________________________
> Express yourself instantly with MSN Messenger! Download today it's
FREE!
> http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
>
>


Luciano R. de Albuquerque
Mestrando - COPPE/Sistemas - UFRJ
Lab. de Redes de Alta Velocidade - RAVEL
http://www.ravel.ufrj.br
http://www.ravel.ufrj.br/~aluciano
http://www.garf.coppe.ufrj.br/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.