Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister

Re^4: OT: Storing encryption keys securely

by Beatnik (Parson)
on Jan 24, 2017 at 13:40 UTC ( #1180211=note: print w/replies, xml ) Need Help??

in reply to Re^3: OT: Storing encryption keys securely
in thread OT: Storing encryption keys securely

Thanks for the feedback!!

Technically, you could already host the database on a secondary server. Either way, there has to be a conduit to the application server (which can be exploited). Adding a second host to the setup (for smaller applications), will not make your users happy. Additionally, the DB credentials also are stored somewhere (code or other place). To be honest, I don't know that many applications that use an outside authentication service for the system keys/passphrases. There's always systems like TACACS+, RADIUS, LDAP but in some way, shape or form, they all require a key of their own to confirm and with the key, it's fairly simple to decode the authentication stream and find out the functional credentials. What I meant by password recovery is that if you 'forget' the encryption keys, there's no way of easily changing the keyphrase. I agree that a passphrase on startup sounds a good idea but it still needs to be stored somewhere, even in memory.. Plus, it's preventing a normal startup process. I can't recall any applications that take this approach. Having a compiled application, for instance, to hide the keyphrase is only slightly less effective as it should be fairly easy to pass the same authentication request as the script is using.

... I'm belgian but I don't play one on TV.
  • Comment on Re^4: OT: Storing encryption keys securely

Log In?

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://1180211]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others making s'mores by the fire in the courtyard of the Monastery: (2)
As of 2021-10-28 17:38 GMT
Find Nodes?
    Voting Booth?
    My first memorable Perl project was:

    Results (96 votes). Check out past polls.