views:

70

answers:

3

I am making a web service that will store public and private keys for each record in a database table.

The keys are made using Java, but I am unsure weather to create a keystore or place the keys inside fields in the databbase directly.

What option would you recommend and what are the benefits of each method?

+3  A: 

If you use a keystore, you'll be using a database that has been designed to keep encrypted items, such as keys and certificates.

Wherever possible, you shouldn't try and re-invent the wheel. Will a keystore suffice in your problem? If you try and design your own database for storing these artefacts, you're going to have to re-solve problems and issues which were taken into account already when creating databases such as Java's keystore.

Noel M
Each record in my table will need to be linked to the keys in the keystore somehow. ie. I need a way to automatically pull the private key out of the keystore (as well as information from the db) and encrypt a message then send it back to the user. So should I be storing the keystore password inside the database record? How do I get around this problem in a secure way? You see there is more than just the public/private key per row, I have id, price, name...etc.
jax
A: 

Why does each record have a private key? This is very strange design. Private keys see generally held by entities, e.g. People, or servers acting on their behalf.

EJP
Each record represents an application. So each application will have it's own private and public keys.
jax
A: 

you can have a database to store userinfo not keys, for keys it is better to use keystore. so userinfo may contain {name, symmetric pass / hash, ...} and using the name you should be able to identify the key-record in the keystore. Again remember, do not use a global (user,pass) to read the keystore, use the user grant instead.

yadab