hi everybody i m writing a web application in java tomcat jsp servlets database access with postgresql this will be released under the gpl and will eventually be useful as a framework for other web applications the application main focus is e commerce but not limited to that i would like to use some form of cryptography to protect data on the database but i have some problem figuring out the right approach above all how to store passwords and keys in a shared web server a problem that i was unable to solve is how to store keys for encryption decryption the api that i m using is the jca jdkNUMBER NUMBER x and the methods of saving generated keys in keystores fails always i can serialize the object and store in the database but this is not the most secure approach this key is needed to decrypt data in the database but the database is accessible from the web application assuming that i can find a good and secure place where to store the database password i can use a different database with different user argh to complex and doesn t really solve the problem where i can found good documentation about this topic there is another approach that i would share with the list something i thought that can be of bit interest but probabily wrong and insecure after all i m a real beginner in secure programming and i m here to learn methods and technics first of all i need a secure way to keep database passwords secure so i have to keep them separate from the main server the right approach could be using a small java bean application that run as normal user not tomcat so it is not shared with other web services or worst the nobody user that has no shell login but has a default home directory or a place where it can hold passwords and keys the web application could then open an ssl connection could be done in the init method at server startup to get database passwords the small bean could check via code signature rmi whatever else that the source is the right one and handle all the database connections or give the db connection password to the main web application in this way we solve the problem of keeping the keys and passwords in shared directories and also an attacker should get root bean user account to read data this is not perfect and works only if your provider gives the opportunity to configure a separated java application that means really another server running in the background any suggestions thank you mario torre please avoid sending me word or powerpoint attachments see URL 