Does keystore has benefits over just encrypted properties?

Question

What is the benefit of using the "proper" JKS keystore over something like AES encryption over just plain property file? Why do keystores exist, which benefits do they provide over encrypted properties?

For more details, we use JKS keystore created with the help of BouncyCastle library. We generate the public/private key pair and keep the private key in the keystore. We also store public key and some other security critical metadata, setting them as properties of this private key.

Answer 1

What is the benefit of using the "proper" JKS keystore over something like AES encryption over just plain property file?

One point is that you would need to manage that encrypted file yourself.

And you cannot make use of other keys and certificate authorities that the user might already have defined.

Why do keystores exist, which benefits do they provide over encrypted properties?

Keystores abstract different ways of managing keys and certificates. Certificates are not always stored in local files. Sometimes they are accessed over the network and in many cases the certificate store depends on some hardware device (like id card readers).

These hardware keystores often do not allow the extraction of private keys from them, in order to keep them more secure. Instead, they provide a programmatic way of signing and/or ciphering data.

Several devices exist. So the keystore manager in the computer needs to use different protocols and drivers to access these hardware keystores.

For example:

• PKCS-11 defines an API to access cryptographic devices.
• PKCS-12 provides a standard to store keys and certificates in a file.

The JKS abstracts and allows you to access this whole ecosystem of keystores.