Re: secure storage of sensitive data in J2EE

On Mon, 2005-02-07 at 14:41 -0500, Kevin Conaway wrote:
> A followup question:
> 
> Once the data (be it a password or a key) has been read into memory,
> what is an effective and secure way of minimizing the window that the
> plaintext key or password is in memory?
> 
> If the data is read into a char [] and then overwritten with junk
> data, would that work?
Not if your buffer gets swapped out beforehand, but the window of
opportunity remains short.

Antoine

> 
> Kevin
> 
> On Tue, 25 Jan 2005 09:18:15 +0000, chaim moshe <[email protected]> wrote:
> > Hello list,
> > 
> > where can I  store sensitive data like encryption keys, passwords, etc. in
> > J2EE?
> > surely, you can save it in the keystore, but the catch is where do you store
> > the keystore password to protect it from external access?
> > storing the keystore password in code or in config files is not secured
> > enough.
> > 
> > In the .NET environment you have DPAPI that was designed exactly for this
> > kind of problem, the sensitive data is encrypted at the OS level with the
> > user/machine password and is decrypted at runtime.
> > What is the solution in the J2EE environment ?
> > 
> > Thanks!
> > 
> > _________________________________________________________________
> > Express yourself instantly with MSN Messenger! Download today it's FREE!
> > http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
> > 
> >