Java keystore password storage

From: john bart (sysadmin256_at_hotmail.com)
Date: 04/25/05

  • Next message: Fredrik Hesse: "Re: Java keystore password storage" 
    To: comp.lang.java.security@news2mail.com, SC-L@securecoding.org, secprog@securityfocus.com, vuln-dev@securityfocus.com, webappsec@securityfocus.com
Date: Mon, 25 Apr 2005 07:55:43 +0000

    Hello to all the list.
    I need some advice on where to store the keystore's password.
    Right now, i have something like this in my code:

    keystore = KeyStore.getInstance("JKS");
    keystore.load(new FileInputStream("keystore.jks"),"PASSWORD");

    the question is, where do i store the password string? all of the
    possibilities that i thought about are not good enough:
    1) storing it in the code - obviously not.
    2) storing it in a seperate config file is also not secure.
    3) entering the password at runtime is not an option.
    4) encrypting the password - famous chicken and egg problem (storing the
    encryption key)

    Any ideas?

    _________________________________________________________________
    Express yourself instantly with MSN Messenger! Download today it's FREE!
    http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

  • Next message: Fredrik Hesse: "Re: Java keystore password storage"

    Relevant Pages

    • Re: Web Service State
      ... Caching is the way we have gone with this, storing each settings class using ... users store the session state. ... - Store state on the server and uniquely identify each visitor. ... We use windows authentication to authorise users to our web service, ...
      (microsoft.public.dotnet.framework.webservices)
    • Re: 1800 $
      ... I'd love to go to a store and try amps but you wouldn't write such an advice ... if you knew Finland: only 5 millions inhabitants. ...
      (alt.guitar.bass)
    • Re: Reading in a file into a Linked List - Segmentation Fault
      ... > Victor Bazarov wrote: ... >> Here you store that address. ... >> which in itself can take all fun out of studying pointers. ... So, it's not storing _values_, it's storing ...
      (comp.lang.cpp)
    • Re: Store private key in cookie?
      ... Storing a key in a file somewhere is generally not a good idea, ... this is not secure) store it in the session object. ... > I was thinking of using RSA to encrypt the Rijndael key/IV. ... > private key in a cookie on a trusted 'admin' machine. ...
      (microsoft.public.dotnet.security)
    • Re: Store private key in cookie?
      ... Storing a key in a file somewhere is generally not a good idea, ... this is not secure) store it in the session object. ... > I was thinking of using RSA to encrypt the Rijndael key/IV. ... > private key in a cookie on a trusted 'admin' machine. ...
      (microsoft.public.dotnet.framework.aspnet.security)