Alternatives to hardcoding a password into the source code

Thread view:

Gyruss - 19 Jun 2005 09:41 GMT

Dear all,

I've written an application that connects to a unix box from windows via
ssh. I use public/private key authentication to do so.

The private key is embedded in the application jar file. The private key is
password protected. The password for the private key is hard coded into the
source code.

Is there any sensible alternative to hard-coding the password into the
source code in this situation?

Cheers!

Reply to this Message

Sebastian Scheid - 19 Jun 2005 10:02 GMT

> Dear all,
>
[quoted text clipped - 9 lines]
> Is there any sensible alternative to hard-coding the password into the
> source code in this situation?

The only secure way I know is not to hardcode sensible data. The user of
your app has to enter the password. You cannot prevent anybody from
decompiling your code. Even an obfuscator does not protect you but only
makes it a little harder for the bad guy.

Perhaps a native compiler could help to make it more difficult (but not
impossible) to decompile your app. But that surely depends on the attacker's
skills.

Regards
Sebastian

Reply to this Message

Chris Uppal - 19 Jun 2005 11:34 GMT

> I've written an application that connects to a unix box from windows via
> ssh. I use public/private key authentication to do so.
>
> The private key is embedded in the application jar file. The private key
> is password protected. The password for the private key is hard coded
> into the source code.

What exactly are you trying to protect ?

Your description is incomplete, but it sounds odd to me that you should be
using private/public key encryption for anything and distributing the /private/
key -- that's exactly what private/public key encryption is designed to avoid.

-- chris

Reply to this Message

Lucy - 19 Jun 2005 20:30 GMT

> Dear all,
>
[quoted text clipped - 9 lines]
>
> Cheers!

md5

Reply to this Message

Alex Buell - 19 Jun 2005 22:29 GMT

> md5

SHA's vastly preferable.

Signature

http://www.munted.org.uk

"Bother!", said Pooh, when his laptop ate his hard disk.

Reply to this Message

Wibble - 20 Jun 2005 01:38 GMT

> Dear all,
>
[quoted text clipped - 9 lines]
>
> Cheers!

The usual pattern is to encode the password and store the encoded
password. Then check that the supplied plaintext password encodes to
the same string. You can put the encoded passwords into a file instead
of hardcoding into your program. The file needs to be read only.

Reply to this Message

Kenneth P. Turvey - 20 Jun 2005 02:16 GMT

> The usual pattern is to encode the password and store the encoded
> password. Then check that the supplied plaintext password encodes to
> the same string. You can put the encoded passwords into a file instead
> of hardcoding into your program. The file needs to be read only.

I think you are misinterpreting what the OP said. He needs a way to unlock
(decrypt) the private key while the program is running. It sounds like he
needs to be able to do this without user intervention. Any method of doing
so is going to have security implications that aren't good.

The best way to handle this is probably to have someone enter the passphrase
when the program is started and have the program simply wait until it is
time to do something. It can run in the background as a daemon.

Signature

Kenneth P. Turvey <kt@squeakydolphin.com>

Reply to this Message

Alternatives to hardcoding a password into the source code

Free Magazines