CODEWITHSUNDEEP
javaencryptionjdbcjava-8
WendyG
WendyG

Reputation: 587

Database agnostic database encrypt

Is there a database agnostic way to encrypt passwords on the database in jdbc? We are using java 8.

I know you can do it when you know which database you will be using, but as we support our customers using multiple platforms we need an agnostic way.

Edited Addition: For example I know in mysql there are these string functions that can be used inside the sql statement. And presumed I had just not found the way to do it agnostically.

Name            Description
AES_DECRYPT()   Decrypt using AES
AES_ENCRYPT()   Encrypt using AES
DECODE()        Decodes a string encrypted using ENCODE()
DES_DECRYPT()   Decrypt a string
DES_ENCRYPT()   Encrypt a string
ENCODE()        Encode a string

Upvotes: 0

Views: 138

Answers (2)

WendyG
WendyG

Reputation: 587

After hunting for examples for my edit i found this answer on a previous post and I agree with it.

Of course, if you write your own routines, assuming that you store the key in the database or somewhere the database has access to, you're not doing much for security. It's bad to send passwords unencrypted over the network but it is generally much worse to store unencrypted passwords in the database (or encrypted passwords if there is a decrypt method in the database that has access to the key to decrypt the data). It's generally a lot easier to steal data from a database than it is to sniff data getting sent over the network in order to find a password.

Encrypt/Decrypt Password in Oracle Function

Upvotes: 0

Kayaman
Kayaman

Reputation: 73528

Using industry standard best practices, you might want to store the salted hash of the password Base64 encoded or as a hex string in a normal varchar/text column. The encryption needs to be done on the Java side, but in the end it's nothing more than storing a String in the table. That should be database agnostic enough as it's a basic JDBC operation.

Upvotes: 3

Related Questions