| java.lang.Object
 org.apache.derby.impl.services.jce.JCECipherFactory
| Method Summary | |
| public String | changeBootPassword(String changeString, Properties properties, CipherProvider verify)
| | public CipherProvider | createNewCipher(int mode)
| | public SecureRandom | getSecureRandom()
| | public void | init(boolean create, Properties properties, boolean newAttrs)
| | static String | providerErrorName(String cps)
| | final public Object | run()
perform actions with privileges enabled. | | public void | saveProperties(Properties properties)
| | public void | verifyKey(boolean create, StorageFactory sf, Properties properties)
The database can be encrypted with an encryption key given in connection url.
For security reasons, this key is not made persistent in the database.
But it is necessary to verify the encryption key when booting the database if it is similar
to the one used when creating the database
This needs to happen before we access the data/logs to avoid the risk of corrupting the
database because of a wrong encryption key.
This method performs the steps necessary to verify the encryption key if an external
encryption key is given.
At database creation, 4k of random data is generated using SecureRandom and MD5 is used
to compute the checksum for the random data thus generated. |
| verifyKey | | public void verifyKey(boolean create, StorageFactory sf, Properties properties) throws StandardException(Code) | | The database can be encrypted with an encryption key given in connection url.
For security reasons, this key is not made persistent in the database.
But it is necessary to verify the encryption key when booting the database if it is similar
to the one used when creating the database
This needs to happen before we access the data/logs to avoid the risk of corrupting the
database because of a wrong encryption key.
This method performs the steps necessary to verify the encryption key if an external
encryption key is given.
At database creation, 4k of random data is generated using SecureRandom and MD5 is used
to compute the checksum for the random data thus generated. This 4k page of random data
is then encrypted using the encryption key. The checksum of unencrypted data and
encrypted data is made persistent in the database in file by name given by
Attribute.CRYPTO_EXTERNAL_KEY_VERIFYFILE (verifyKey.dat). This file exists directly under the
database root directory.
When trying to boot an existing encrypted database, the given encryption key is used to decrypt
the data in the verifyKey.dat and the checksum is calculated and compared against the original
stored checksum. If these checksums dont match an exception is thrown.
Please note, this process of verifying the key does not provide any added security but only is
intended to allow to fail gracefully if a wrong encryption key is used
StandardException is thrown if there are any problems during the process of verification
of the encryption key or if there is any mismatch of the encryption key.
|
|
|