CODEWITHSUNDEEP
javadatabaseencryptionpasswordsjasypt
FoxyBOA
FoxyBOA

Reputation: 5846

Java: What is the best option to store encrypted database (and other) passwords in property files?

I examine Jasypt for storing database encrypted passwords in property files. It has good integration with Spring etc., but approach of that this guys propose for encrypting password looks a bit weird as for me:

  1. Use PBE (symmetric algorithm) encryption.

  2. Store password for encryption/decryption in environment variable or in source code.

Both options look unsafe and a bit insecure.

My questions:

  1. What is the best practice for storing encrypted passwords?
  2. Can I use key based encryption (i.e. private/public keys) here?

Upvotes: 0

Views: 1735

Answers (1)

Sanket Desai
Sanket Desai

Reputation: 36

In our application we use two approaches:

  1. We use a enterprise password vault which stores the passwords for all our databases. Our web sever requests the password from the vault to connect the database every time.

  2. We store Encrypted passwords in properties file. And during the application startup we read the properties file using class loader and keep it as a system variable and use it whenever needed.

It is difficult to have public/private key encryption directly with db, you would need an intermediary to do this.

Upvotes: 2

Related Questions