2

I've been searching the whole last week for any solution but could not find any proper answer and I hope one of you can help me.

I've got an Java desktop application which uses a local H2 database (embedded mode) on a linux machine. The database uses an symmetric encryption with a password. The application can be used by anybody without asking for any kind of credentials, passwords or login information. The database secret should be hided and not be visible or editable by users. Finally the application does not have a internet connection.

Is there any solution to provide the secret to the application for database encryption while protection the password from users? Or is there any other solution to protect the database data from user access while providing the data to the application?

Thank you in advance

Sebastian

Improve this question

2 Answers 2

Reset to default
2

Do your users have admin rights on their respective desktop machines? If yes, there's no way you can hide the password from a motivated user for long. Methods like obfuscation and so on may help preventing a curious but lazy user from discovering your secrets, without any guarantee though.

If no, allow your users to run the application but forbid debugging it and reading the secrets file. How exactly do you do that depends on what OS is used in your organization.

Note that this also requires you to install all the security updates on users' machines as soon as it's possible, as elevation of privilege is among the most frequent consequences of vulnerabilities out there.

Improve this answer
3
  • Thank you for your quick answer. No user don't have admin rights on the machines. How is it possible to forbid debugging of an Java application? Do you have some experience in doing this? Your approach will protect the secrets file by rights management? How will the application be able to get the secret if it is blocked by rights?
    – Seb
    Commented Jan 23, 2018 at 18:29
  • There are numerous ways to do that. What's your OS platform and version? It's heavily dependant on that. Say, under Linux the simplest way is suid, but there are other platforms and better ways.
    – ximaera
    Commented Jan 23, 2018 at 19:32
  • Ok, thank you. If you can choose an OS platform which solution would you recommend and why? thanks for your help!
    – Seb
    Commented Jan 24, 2018 at 14:21
1

Basically there is no proper way to encrypt sensitive data when you are talking about software based solution. One of the solution that you can adopt is a very strong obfuscation mechanism this may help you get the secret hidden. Or better use White-box cryptography you can check this link for further information: http://www.whiteboxcrypto.com/

Improve this answer
2
  • Thank you for your quick answer. As I read these days that whitebox-crypto is not secure. Do you know some secure implementations? thank you
    – Seb
    Commented Jan 25, 2018 at 12:39
  • Yes I agree, the whitebox-crypto is not as much secure as hardware based solution but it still something not easy to break. I think a secure implemention rely on the architecture you are working on. because when you put all the logic at the client side it becomes more complicated to make your application secure.
    – Yazid
    Commented Jan 25, 2018 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .