Storing passwords of external systems in encrypted form in the J2EE application

Question

We have a J2EE application that interacts with several external systems. Each external system wants our application to be authenticated by username / password. Therefore, when we talk with an external system, we need to send a username / password. The problem is saving these passwords. We want to keep these passwords safe. Obviously, we cannot use MD5 to hash the password, because we need to send the password to an external system. Therefore, we need to encrypt the password.

• Where to store the encrypted password. Database?
• Where to store the encryption key?

What is the best practice for this particular problem?

Answer 1

I am not an expert, but I also have similar requirements. This article from security.stackexchange.com discusses the issue. The accepted answer provides alternatives. Shortly speaking:

• store them in the file system, which makes them vulnerable if someone gains access to the file system.
• force the administrator to enter them at boot time

Answer 2

.
AES-CBC, , IV, IV , IV . / -.

:

, .

Answer 3

gpg / . , ( ), , , - , , .

Answer 4

- . -, , . . :

• , .
• .
• .
• ( ), .
• The server combines the verifier with the client credentials to obtain a common shared key.
• The client combines the password with the server credentials to obtain a common shared key.
• If the keys are identical, authentication was successful.

Since the password is not stored on the server and is not sent by the client, it cannot be stolen.