I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables is unencrypted (whilst in development) but I am planning on using PBKDF2 to encrypt these with a salt that will be stored within a .properties file. The MySQL server for this application is stored on the local drive with the application. And no network traffic is needed for this program to work, nor has any been planned for it. There is a high probability that the client will connect the computer hosting this application to the internet through the local LAN/WLAN.

Anyway, to my question. The client has just informed me that they also need to store the bank details of the vendors. So if I made another table, where the data is linked through a foreign key to the ID of the vendors, and this table contained all of the bank details, and then hashed this information with a salt that I could store in a .properties file, which is then hashed as well, would this be a secure enough approach? Or would there be a better way to approach this problem (besides steering clear of storing bank details)?

  • 1
    I'm a little confused when you talk about hashing the bank details. That won't allow retrieval of the details so it doesn't make a whole lot of point in storing them. PBKDF2 uses a hash of the password the user inputs to generate an encryption key, it doesn't hash the actual data being stored. The salt that was used with the user's password to generate the key has to be kept, but it doesn't have to be associated with the data necessarily. – AJ Henderson Jul 1 '14 at 12:45
  • LAN/WLAN is network, and if you encrypt the data with PBKDF2 it will not be retrievable (which maybe what you want?). Hashing is a one way function. This sounds like its already in development, but is not suitable for the latest specification - storing bank details. Please, stop what you are doing and seriously consider the implications of the current design. It seems like its not suited to the specification changes put upon you. – user2867314 Jul 1 '14 at 13:10
  • At current the procedures for encrypting the data is in the investigation phase. The bank details section has not been implemented into the program yet, as I am still investigating the best way to ensure that the data is protected (as much as possible). Any recommendations on how to ensure security will be greatly appreciated (even if it entails a redesign of the current processes) Edit Just to restate, the current design will not be getting called over LAN/WLAN, that was mentioned to state that the computer housing will be mostly a standalone, but will be accessible through LAN – Fos Jul 1 '14 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.