Instead of holding all decryption information in the password text itself (see obfuscation and PBE encryption), this method uses a key from an external Java KeyStore. The encryption method is asymmetric, e.g. RSA.

The security of asymmetrically encrypted passwords is high.

Setting up the Java KeyStore

If no Java KeyStore is available, it can be created with the following command. The location of the generated Java KeyStore should be in a directory accessible only to the user running the Lobster Integration process.

Note: Here, the directory "etc\admin" (./etc/admin) was used, which is the default directory for configuration files in the following steps. However, any other directory suitable for the purpose may be used.

Note: For the example, use the keystore password "my keystore password" (of course you can choose any password later).

Note: If you see an empty input field in the example, you can also leave it empty (press return).

Note: You can ignore the warning.

D:\IS>keytool -genkey -alias lobster -keyalg RSA -keysize 2048 -keystore etc\admin\pwd_ks.keystore
Enter keystore password:
Re-enter new password:
What is your first and last name?
  [Unknown]:  Test Keystore for Config Password Encryption
What is the name of your organizational unit?
  [Unknown]:  IT
What is the name of your orginization?
  [Unknown]:  Lobster GmbH
What is the name of your City or Locality?
  [Unknown]:
What is the name of your State or Province?
  [Unknown]:
What is the two-letter country code for this unit?
  [Unknown]:  DE
Is CN=Test Keystore for Config Password Encryption, OU=IT, O=Lobster GmbH, L=Unknown, ST=Unknown, C=DE correct?
  [no]:  yes
 
Enter key password for <lobster>
        (RETURN if same as keystore password):
 
Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore etc\admin\pwd_ks.keystore -destkeystore etc\admin\pwd_ks.keystore -deststoretype pkcs12".

As result you get the keystore file ./etc/admin/pwd_ks.keystore.

Configuration file for password encryption with Java KeyStore

When creating the Java KeyStore, the password my keystore password was used, which secures the private key of the Java KeyStore. This password must be stored in the following configuration file ./etc/admin/ks.properties.

keystore_lobster
keystore_lobster.filename=./etc/admin/pwd_ks.keystore
keystore_lobster.password=my keystore password
#keystore_lobster.type=JCEKS
#keystore_lobster.provider=BC

Password encryption with the Java KeyStore

Once the preparations are done, you can now create an asymmetrically encrypted password.

D:\IS> bin\password.bat -k lobster "some password"
$KS$lobster$QUgjl4kFMzU9Zm0+4QXd5reP+GyHWpqION3vd4ZXBH6F90YWmZErS/V5ernNBBnHZCLzci+bbe3rVbIkCjTf1tI9Zmsv03DDb4JTjUbJ8G4l4hhhlpOUM+2/b+VvS2Nhb9vRJ29z7j2K+cBbzVQ7wEYOGIPi2Atv9Vpv1+zN2PheZZs9rqNEU3LgAMV9fsUOTkQUvyo23fhVxHXNJFxMubs369dU8+5yEX0U6wRPMeHIKS+OoEvt3APaXitZ+8NwYxmvdgukUdBs9AYKMQBN6YKEkGpKFojIboTWzFdBUpz5rUWWj+pQbPrxoJ33YlttjAxXwKbyeyEGw4CUV76asw==$2VXmZat8L5psiwlhX1AREw==

→ The displayed $KS$ value can be copied directly from the console and inserted into the desired configuration file as a password.

Preliminary summary:

Create the Java KeyStore (with keystore password).
Create the configuration file for the Java KeyStore (with the keystore password in plain text).
Asymmetrically encrypt the password for your configuration file using the script (which uses the Java KeyStore and its configuration file).

Important note: Since it is obviously unsafe to specify the password in plaintext, obfuscation or PBE encryption (with specification of the PBE password!) can be used. As we have already seen, however, these two methods are not very secure either. Therefore, we recommend using a master password instead.

Using a master password

Creating the master password configuration file

We use our script to create the file that contains the master password (my secret masterpassword).

D:\IS> bin\password.bat -j "my secret masterpassword" 2> etc\admin\ks_auth.properties

As result you get the master password file ./etc/admin/ks_auth.properties. Important note: The file must be protected against unauthorised read access for the scenario to be safe!

Encrypting the Java KeyStore password

So far, our Java KeyStore password (my keystore password) in the Java KeyStore configuration file ./etc/admin/ks.properties is in plaintext.

The next step, therefore, is to encrypt this password with the PBE method using our master password (my secret masterpassword) without outputting the password part (option -jo).

D:\IS> bin\password.bat -jo "my keystore password" mysalt 57 "my secret masterpassword"

As result of the call we get:

$JB$MASK-S4x5hUiT4VqvQoY0ATPm70BvWS+s0TCY$bXlzYWx0$57$$

Now we use this password instead of the plaintext password we have used so far in the Java KeyStore configuration file ./etc/admin/ks.properties (line 3).

keystore_lobster
keystore_lobster.filename=./etc/admin/pwd_ks.keystore
keystore_lobster.password=$JB$MASK-S4x5hUiT4VqvQoY0ATPm70BvWS+s0TCY$bXlzYWx0$57$$
#keystore_lobster.type=JCEKS
#keystore_lobster.provider=BC

Now we can use our script again to asymmetrically encrypt our configuration file password (some password).

D:\IS> bin\password.bat -k lobster "some password"
$KS$lobster$VyZI+9Ywh6ISGR+5f4e/k550FxsT9/xefTaOJgorAQW9k4frNq4EeGeSI1Xd3O8vob6reoRRZADhWJJUXeD7fqpvGHJw84q8HiLs/5lqUt1p/hNr6BsByFMcVvY1lF2qD9Ltr9S6H94gT/p4Jqw2fnwVdS+NMWxJGqacNsUqaP7413jBPx0Kpmi4WuzdeP3k/CblyuF0ZjErKer9+rhuGqpdka8DIwZJ1wJCp7bO78Qy3mrN/q9s8u9N1IoaF5GJrtqOnCGXG0ZaA9mPF3/bJxPjMaOXRjpfbfI1V+bcdMQWfKP04sF5ot99rDlZ9xLLRRaY3l7uYGXDdKVUh3/uvA==$SMxzDLS2kKeRaHXOx8WQLg==

→ The displayed $KS$ value can be copied directly from the console and inserted into the desired configuration file as a password.

Summary:

Create the Java KeyStore (with keystore password).
Create the master password configuration file.
Encrypt the KeyStore password with the PBE method and the master password.
Create the configuration file for the Java KeyStore (by using the PBE-encrypted KeyStore password from 3).
Asymmetrically encrypt the password for your configuration file by using the script (which uses the Java KeyStore and its configuration file).

For a better understanding: As before, the Java KeyStore configuration file is used to asymmetrically encrypt our configuration file password (some password). But now the KeyStore password is no longer specified in plaintext in the Java KeyStore configuration file and instead was encrypted with the PBE method (without outputting the PBE password part). The PBE password part is taken from the master password file (also encrypted with PBE).