Java encryption alternitive to hardcoded key

Question

I am new to encryption.

I have looked at the javax.crypto documentation and got encryption of a file to work using this code ...

File saveFile = new File         


        

Answer 1

If the attacker has access to both the software and the file, it could decrypt it. There are some ways to solve this:

• Use asymetric keys. Encrypt the file with the public key, and it can only be decrypted with a private key. This assumes that the software does not need to decrypt the file.
• Use Diffie-Hellman exchange. If you want to send an encrypted piece of data over the network, both parties can establish a key without an attacker knowing about it.

If the program needs to both encrypt and decrypt the data, there is nothing you can do. The attacker can simply run the program and look at the decrypted information.

Answer 2

An attacker can always do everything the program can do and usually quite a bit more. The only way to get things secure is the use information not under control of the program. Request the user to enter a password or put information in a store under control of the operating system. The later will not help if an attacker has physical access or maybe even a lot of rights unless special hardware like a Trusted Platform Module (TPM) is involved.

Answer 3

the most secure method is not use any encryption, just put your user.properties to your home directory, with following code:

String userhome = System.getProperty("user.home");
String username = system.getProperty("user.name");
String hostname = java.net.InetAddress.getLocalHost().getHostName();

if (hostname.equals("webserver") && username.equals("root")){
ResourceBundle user = ResourceBundle.getBundle(userhome/ "user.properties");
}

Answer 4

Well if the program can decrypt the data without additional input from the user, you can't really avoid someone else from accessing the file if he has access to the program.

If you are targeting Windows only, you might want to take a look at the Data Protection API (DPAPI). It essentially does the same thing, but the passphrase used for encryption is protected by the operating system on a user (or machine) scope. Simply put: you need the user login (or a program that runs on the given user account) to access the key (or for machine scope the login for any user on the machine).

I don't know how to access the API from Java, but Google brings up some wrapper libraries.

Answer 5

If your program can encrypt / decrypt a file on its own, then everything you need to perform the decryption is already built into the program, so a determined troublemaker could decrypt files you encrypted.

If possible, ask the user for a 'password,' and use what they give you as the encryption / decryption key.

Answer 6

Don't hardcode the key. Assuming you don't have a user on hand to enter the passphrase, configure your code to pull the encryption key from a plain file, then rely on operating system security to keep the file safe. Provide a way to migrate to a new key when the system administrator deems it necessary.