Assume I have a Java app running on a Linux server. The app needs a secret key to do a task, such as decrypting or encrypting a file, after it starts up. This is a question about best practice for keeping the key "safe".

Ideally we want to avoid the key being known to the developer (separation of duties), or the wider world if the code is made public (by accident or on purpose). This would mean we cannot put the key in the source code or put it in a properties file in the same code base.

I vaguely understand that ideally the key is stored on a smartcard or hardware security module (HSM) but I would like to know about possible solutions without resorting to hardware.

At my previous place of employment I vaguely remember the key file being generated by an ops team and placed inside a location (seperate account or directory) and a combination of account permissions and process permissions being used to keep the key separate.

In Java there is the option of storing keys in the KeyStore and then protecting the password for the KeyStore (I think thats how it works).

Can anyone tell me exactly how the key (or KeyStore password) separation would work with an explanation of the exact permissions required? For example, should the executable be deployed to account A directory A but somehow run as account B and therefore have access to directory B? If so then what do the permissions look like for all that? I know it looks like I am being lazy but I am worried I will not understand without a concrete example to walk through!

Even with an approach like that above, is there still the risk that an attacker could get the key if the app server is compromised (RCE for example)?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.