Re: secure storage of sensitive data in J2EE

--==_Exmh_1107828829_17298P
Content-Type: text/plain; charset=us-ascii

On Tue, 08 Feb 2005 00:36:41 GMT, Antoine Martin said:
> On Mon, 2005-02-07 at 14:41 -0500, Kevin Conaway wrote:
> > A followup question:
> > 
> > Once the data (be it a password or a key) has been read into memory,
> > what is an effective and secure way of minimizing the window that the
> > plaintext key or password is in memory?
> > 
> > If the data is read into a char [] and then overwritten with junk
> > data, would that work?
> Not if your buffer gets swapped out beforehand, but the window of
> opportunity remains short.

If you are on a system where you can use mlock(), that can help minimize
the swapped-out-buffer issue.  Not sure if you can get at mlock() from the J2EE
environment, though....

--==_Exmh_1107828829_17298P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFCCCBdcC3lWbTT17ARAvmmAKCrWFl1l6ICjpt+6qOrrbeXbRtvZgCfVIwB
9aj40nKUL8r7N983dcYBGhI=
=8/Ch
-----END PGP SIGNATURE-----

--==_Exmh_1107828829_17298P--