Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the program. There is no way of providing input as it is only based on api access.

What is best place to store the Java keystore password & in what format it should be stored?

share|improve this question

1 Answer

up vote 2 down vote

If you hope to keep the private keys out of the hands of whoever runs your program, then it will not work. Secrets embedded in code do not resist reverse engineering (especially when using Java, which is quite easy to reverse-engineer).

Though you do not give any detail about your situation (you just say "Java" and "the program"), I can give the following generic advice: arrange for your private key to be user-specific, and such that it is the user's best interest that the private key remains private. In that case, the user will collaborate to the key security. You may then store the private key (or a password which unlocks the private key) in the Java preferences.

share|improve this answer
actually there is no user specific keys, its data specific. In my situation, the keystore is storing the keys which can encrypt/decrypt the data & user accessibility to the method that read from this keystore & the data is only after proper authentication. That is why I said the access is with program. – Deepesh M Feb 18 at 3:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.