• Don't allow individual users of the system to mark identities as trusted. The system administrator should mark identities as trusted.

• Don't allow malicious users to gain access to the private keys of users who are marked as trusted in your system.

Since the identity database is an unencrypted file and is subject to "insider attacks", the system administrator for your site should store the site's identitydb.obj in a protected area of the file system. Only the system administrator should add and remove identities to this database, and only the system administrator should mark identities as trusted.

We recommend that individuals create and store their private keys locally, and submit their public keys to the system administrator, who can then add their public key to the system-wide identity database. It is up to the discretion of the system administrator whether or not an individual's identity should be entered into the database as trusted.

Recommendations for individuals

1. Install your own version of JDK 1.1 in a secure area
2. Add the property

   	identity.database=/a/safe/directory/mydb.obj 
   

   to the property file found in

   	$DESTDIR/lib/security/java.security
   

   where DESTDIR is the name of the directory where you installed JDK 1.1.

For example, if I install JDK 1.1 in /usr/jdk1.1, and

• that area is not exported from my computer
• I don't allow unauthenticated logins to my computer
• that file system is read-only by me alone

then I can feel confident that my identity database, which contains my private key, is protected.

Recommendations for system administrators

1. Create the system's identity database in a secure area of the file system. Add the property

   	identity.database=/a/safe/directory/systemdb.obj 
   

   to the property file found in

   	$DESTDIR/lib/security/java.security
   

   where DESTDIR is the name of the directory where you installed JDK 1.1.

   Use whatever file protection mechanisms are available on the underlying operating system to safeguard this file. Only the authorized system administrators for your site should be allowed to modify this file.

2. Ask individuals to send you their public keys, in X.509 certificate format, as generated by javakey. Be sure that they submit their identity's nickname along with the X.509 certificate itself.

3. Add the certificate to the system database

4. If warranted, mark the newly-entered identity as trusted

Back to Using javakey

Last modified 09/28/99

java-security@sun.com