How and where to store a SecretKey

Thread view:

David Segall - 26 Jan 2008 16:52 GMT

The typical tutorial on Java encryption such as
<http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.ht
ml#SimpleEncrEx>
shows you how to generate a SecretKey and use it immediately to
encrypt and decrypt some text. I have not found any guidance on where
I might store the key or what format it is in. How can I store the key
in a database or in a property list?

Reply to this Message

Stefan Ram - 26 Jan 2008 17:06 GMT

>I might store the key or what format it is in

The key is not »in a format«.

It is an object.

An object is being defined by its behavior.

Some objects have a state that can be serialized
(written) and be deserialized (read) later.

If this applies, it should be possible to learn
more about it in the documentation of the class
of the object.

(Notwithstanding the question whether it is wise
to store a secret key in a database.)

Reply to this Message

Arne Vajhøj - 26 Jan 2008 20:55 GMT

> The typical tutorial on Java encryption such as
> <http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.ht
ml#SimpleEncrEx>
> shows you how to generate a SecretKey and use it immediately to
> encrypt and decrypt some text. I have not found any guidance on where
> I might store the key or what format it is in. How can I store the key
> in a database or in a property list?

SecretKey is serializable and can be stores as such.

But I think it is much more common to store the bytes used
to construct the SecretKey (SecretKeySpec).

Where to store it depends on the context.

Arne

Reply to this Message

Roedy Green - 27 Jan 2008 02:53 GMT

>The typical tutorial on Java encryption such as
><http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.ht
ml#SimpleEncrEx>
>shows you how to generate a SecretKey and use it immediately to
>encrypt and decrypt some text. I have not found any guidance on where
>I might store the key or what format it is in. How can I store the key
>in a database or in a property list?

A good place to put it would be a thumbdrive. That way it all trace
of it is gone from the computer, and unavailable to hackers.

see http://mindprod.com/bgloss/thumbdrive.html

A thumbdrive just looks like a tiny hard disk to Java.

Signature

Roedy Green, Canadian Mind Products
The Java Glossary, http://mindprod.com

Reply to this Message

How and where to store a SecretKey

Free Magazines