Have Geek Brain

Loading a keystore without checking its integrity

This question is in the specific context of the java.security.KeyStore Java class and its loading (InputStream stream method, char [] password), which can take null values ​​for the password to bypass the integrity check.

What are the risks of loading and querying a key store without checking its integrity? Keystore will be prompted for the user's private key, which will be used to sign the opt-out document. The requested certificate will be additionally verified against the copy stored in the database during user registration and (presumably exactly the same) certificate.

0


a source to share


1 answer


Well, the main risk is that anyone who can read the file can modify it as well. This way, someone might replace the file you are reading with a different keystore that has the same names for the keys, but contains a different private key, so you end up signing documents with the wrong private key, and none of them will be verified.



Also, anyone with access to the file gains access to the private key and can sign documents as if they were coming from your application.

0


a source






More articles:


All Articles