All,
We've had a few vulnerability reports against the EncryptInterceptor
recently and that got me thinking whether there was an alternative
solution that was worth exploring.
My initial thought was to use (D)TLS with a pre-shared key (PKS). This
would provide encryption for the entire communication all based of a
single, shared key.
Unfortunately, the standard JSSE implementations (Oracle, Temurin etc)
don't implement any PSK ciphers. Bouncy Castle does implement some PSK
ciphers (I haven't checked exactly which at this point) but doesn't
expose them via the JSSE provider - only via its own proprietary API.
I'd prefer a solution that depended on standard Java APIs so I started
to think along the lines of a script that could generate a local
certificate (or CA and set of certificates - details TBD) that could
then be used with the standard JSSE provider.
The aim would be to deprecate the EncryptInterceptor with this (built
into standard clustering) as the replacement. There are various settings
for "secure" communications that are currently unused.
Do folks think this is worth pursuing? If so, with which approach? Some
other approach?
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
