Re: Java keystore password storage

On 4/25/05, Michael Howard <[email protected]> wrote:
> Oh this thorny issue again!
>=20
> On Windows you can call into the Data Protection API (CryptProtectData
> etc), which uses keys derived from the user's password to protect secret
> data like this, or uses a machine key if you want to lock the key down
> to the machine. Mac OSX offers a similar technology called Keychain
> (SecKeychainAddGenericPassword etc), but these are of course OS specific
> solutions.
>=20
> I know of no other way that works solely with Java on all platforms...
>=20
> [Writing Secure Code] http://www.microsoft.com/mspress/books/5957.asp
> [Protect Your PC] http://www.microsoft.com/protect
> [Blog] http://blogs.msdn.com/michael_howard
> [SDL] http://msdn.microsoft.com/security/sdl
>=20
> -----Original Message-----
> From: john bart [mailto:[email protected]]
> Sent: Monday, April 25, 2005 12:56 AM
> To: [email protected]; [email protected];
> [email protected]; [email protected];
> [email protected]
> Subject: Java keystore password storage
>=20
> Hello to all the list.
> I need some advice on where to store the keystore's password.
> Right now, i have something like this in my code:
>=20
> keystore =3D KeyStore.getInstance("JKS");
> keystore.load(new FileInputStream("keystore.jks"),"PASSWORD");
>=20
> the question is, where do i store the password string? all of the
> possibilities that i thought about are not good enough:
> 1) storing it in the code - obviously not.
> 2) storing it in a seperate config file is also not secure.
> 3) entering the password at runtime is not an option.
> 4) encrypting the password - famous chicken and egg problem (storing the
> encryption key)
>=20
> Any ideas?
>=20
> _________________________________________________________________
> Express yourself instantly with MSN Messenger! Download today it's FREE!
>=20
> http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
>=20
>