3

I'm developing a cross-platform Java desktop application which uses a password to derive a cryptographic key. I'd like to add a "Remember me" feature that stores this cryptographic key on the hard drive securely so that my program can get it after a reboot.

If I store it directly, anyone who manages to get access to a typical user's hard drive (no encryption) will be able to get the key. If I encrypt it, the key used to encrypt it must still be stored somewhere on the drive, and hence defeats the purpose.

I've seen gnome-keyring, Windows Credential Manager, and Mac OSX keychain, but they each seem to have their own non-Java APIs (or unofficial ports to Java). Furthermore, it seems like any program running as the user will be able to read or write to or from these two services.

Is there a more portable (and preferably isolated) way to securely store passwords (or cryptographic keys) on the hard drive?

Thanks!

Improve this question

1 Answer 1

Reset to default
4

On today's systems, you can use TPM. It can be used to store (or wrap) the root key and protects additional keys created by an applications. The application keys cannot be used without the TPM, making this a very useful authentication method for endpoint devices.

Read about the how-to here .

Another advanced method which will probably be used a lot in the future is to use Physically Unclonable Functions. Instead of keys being stored (and susceptible to reads), keys are instead derived from unique physical properties of a chip’s SRAM memory and exist only when powered up. Using an SRAM-based PUF, the keys are guaranteed to be unique since they utilize the inherent randomness in silicon bit patterns. Even if this sounds more futuristic, it's something usable today.

PUF Details and documentation about key storage using this method.

Improve this answer
4
  • 2
    The TPM access API will likely be platform-specific though.
    – Polynomial
    Jun 7, 2018 at 17:11
  • Looks like I found a TPM wrapper from Miscrosoft that seems to support both Windows and Linux. Unfortunately my computer doesn't have a TPM... Is a TPM something that most end-user computers have?
    – id01
    Jun 7, 2018 at 23:29
  • Now-days, yes. Laptops have been sold with a built-in TPM chip since 2006.
    – Overmind
    Jun 8, 2018 at 12:46
  • Wow, I just realized that both my desktop and laptop have integrated TPMs without me knowing. Thanks!
    – id01
    Jun 9, 2018 at 21:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .