Re: embedded keys - there has to be a less vulnerable approach

From: John Veldhuis (john.veldhuis_at_universal.nl)
Date: 06/30/03 

Date: Mon, 30 Jun 2003 12:41:13 +0200

Andrew Mayo wrote:
> A problem that seems to be increasingly common these days involves the
> idea of protecting information in a source such as a relational
> database, which by its nature is intended to facilitate the sharing
> and retrieval of information.
>
>snipperdiesnip
>
> The problem here, however, is that encrypting and decrypting the data
> require either a single key in the case of symmetrical encryption
> algorithms (e.g DES, Blowfish, etc), or a public/private keypair if
> asymmetrical algorithms such as RSA are used.
>
> This key (or keys) must be preserved as a secret, most usually by
> embedding it within the application, ideally in such a way that the
> key bytes are scattered randomly throughout the executable image.
>
> So, any thoughts, folks?

I think of HSM, eg. an IBM 4758, which can store keys securely, and can
be adressed via PKCS#11.

Groetjes
   John