Hi everybody!
I'm writing a web application in java (tomcat + jsp/servlets + database
access with postgreSQL).
This will be released under the GPL and will eventually be useful as a
framework for other web applications.
The application main focus is e-commerce, but not limited to that.
I would like to use some form of cryptography to protect data on the
database, but I have some problem figuring out the right approach.
Above all, how to store passwords and keys in a shared web server.
A problem that I was unable to solve is how to store keys for
encryption/decryption. The api that I'm using is the jca (jdk1.4.x),
and the methods of saving generated keys in keystores fails always.
I can serialize the object, and store in the database, but this is not
the most secure approach: this key is needed to decrypt data in the
database, but the database is accessible from the web application.
Assuming that I can find a good and secure place where to store the
database password, I can use a different database with different
user... Argh... to complex and doesn't really solve the problem.
Where I can found good documentation about this topic?
There is another approach that I would share with the list, something I
thought that can be of bit interest, but probabily wrong and insecure.
After all, I'm a real beginner in secure programming, and I'm here to
learn methods and technics.
First of all, I need a secure way to keep database passwords secure, so
I have to keep them separate from the main server. The right approach
could be using a small java bean application that run as normal user
(not tomcat, so it is not shared with other web services or, worst, the
nobody user), that has no shell login, but has a default home directory
or a place where it can hold passwords and keys.
The web application could then open an ssl connection (could be done in
the init method at server startup) to get database passwords. The small
bean could check via code signature/rmi/whatever else that the source
is the right one, and handle all the database connections, or give the
db connection/password to the main web application.
In this way, we solve the problem of keeping the keys and passwords in
shared directories, and also, an attacker should get root/bean user
account to read data. This is not perfect, and works only if your
provider gives the opportunity to configure a separated java
application (that means, really, another server running in the
background).
Any suggestions?
Thank you,
Mario Torre
--
Please avoid sending me Word or PowerPoint attachments.
See http://www.fsf.org/philosophy/no-word-attachments.html