Does anyone know of a good way for me to encrypt hibernate.properties credentials? I have looked at Jasypt but fail to find any guidance on how to implement it. Particularly in how to decrypt and use in the hibernate structures.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
doesn't matter. There'd still be the option to run it through some hacked JVM or run it in a debugger and see the decrypted code that way.
If these guys don't trust their security, they have problems far more serious than can ever be solved by putting some encryption on a password inside a properties file inside a jar file inside a war file inside an ear file (hey, let's take an extreme example) in a password protected directory on a server that can be accessed only over ssh connections through a vpn tunnel and is positioned in a locked room in a secured facility.
If they lack any of those security measures implementing those (except maybe the vpn tunnel) having you jump through hoops to hack Hibernate to have a way to use encrypted passwords isn't going to make the system any more secure.
Their problems are with either their physical security or a severe mistrust of their own employees. In either case their "requirement" is misplaced and only gives them a false sense of security.
I've built systems that handled multi-million Euro transactions. At no time was the customer ever worried about having database information available in the system configuration.
They were professionals, realised full well that you have to have an unencrypted password or key somewhere because if you don't you've nothing to use as the start of your decryption sequence (if you were to have an encrypted password you'd have to store the decryption key. That's another security risk so your customer would want you to encrypt that too no doubt, but how would you decrypt an encrypted key?).
It's silly I know.
The client's DB group has a protocol about not exposing any credentials - in plain sight - regardless of what application types are utilizing it.
It's a protocol they need to comply with - at least with a mild amount of effort I have been informed.
So initially encrypting them is the accepted solution. Instead of "cracking open" the hybernate structure, I'm just going to leverage my own encrypted config file that I will access through the classloader to load into my Hibernate session factory, unencrypt the values, and set properties.
It seems they are OK with that. Keys or not.
More work for me :(
Business Accounts
Answer for Membership
by: jwentingPosted on 2009-07-22 at 22:48:05ID: 24922135
You can't. Either you trust your system to be secure against instrusion or you don't. And if you don't, the solution is to make it secure.
If someone could get into your configuration to find the password he could also find a way to retrieve the decryption key anyway.