How to Securely Encrypt Passwords in Configuration Files

Encrypting passwords stored in configuration files is crucial for safeguarding sensitive data and preventing unauthorized access.

Using Password-Based Encryption (PBE) in Java

A simple and effective method for encrypting and decrypting passwords is to utilize Java's Password-Based Encryption (PBE). PBE allows you to derive a key from a password using a secure algorithm, such as PBKDF2WithHmacSHA512.

Implementation Steps

1. Generate a Salt: Create a random salt to make brute-force attacks more challenging.
2. Derive the Encryption Key: Use SecretKeyFactory to derive an AES key from the password and salt using the PBKDF2WithHmacSHA512 algorithm.
3. Encrypt the Password: Initialize a Cipher with the AES/CBC/PKCS5Padding algorithm and encrypt the password using the derived key.
4. Store the Encrypted Password: Store the encrypted password along with the salt in the configuration file.
5. Decrypt the Password: When reading from the file, instantiate a Cipher with the same algorithm and key, decrypt the password using the salt, and obtain the original plaintext.

Example Code

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;

// ...

SecretKeySpec key = createSecretKey(password.toCharArray(), salt, iterationCount, keyLength);
String encryptedPassword = encrypt(originalPassword, key);
// ...
String decryptedPassword = decrypt(encryptedPassword, key);

Storing the Encryption Password

One challenge remains: where to store the password used for encryption. Options include:

• Obfuscate in Source File: Store the password in the source code and obfuscate it to make it harder to retrieve.
• Provide as System Property: Pass the password as a system property when starting the program (e.g., -DpropertyProtectionPassword=...).
• Use a Key Store: Utilize a KeyStore protected by a master password.

It's important to note that it's difficult to securely store the master password, but these methods can enhance the security of passwords in configuration files compared to storing plaintext.