Cryptography Key Storage question

Thread view:

epilot2006@bellsouth.net - 27 Sep 2007 08:27 GMT

Hello,

I am developing a simple class to encrypt/decrypt passwords for
storage in a configuration file (XML based). Currently, the key for
the cryptography is stored as a static byte[] in my cryptograpy
class. I imagine that this is not very secure, for when I compile it,
I can easily decompile it to retrieve the key. What is the standard
method for storing a symmetric key in this sort of instance? A single
applet is used to store and retrieve the key from the configuration
file.

Thank you!
James

Reply to this Message

Dave - 03 Oct 2007 17:29 GMT

2 things you could do are to store the key in a java keystore, PKCS12
file, or PKCS11 based hardware token or derive the key every time you
need it using one of the password-based encryption algorithms (http://
java.sun.com/javase/6/docs/technotes/guides/security/
StandardNames.html#SecretKeyFactory, look at the ones starting with
PBE, http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.ht
ml#SecretKeyFactory).
Both would require some user input every time you run the program or
you'd need to hardcode the password into the code which isn't much
better than hardcoding a key.

Dave

epilot2...@bellsouth.net wrote:

> Hello,
>
[quoted text clipped - 9 lines]
> Thank you!
> James

Reply to this Message

Cryptography Key Storage question

Free Magazines