title: Is Jboss 5.1.0 Password Based Encryption Secure?
body: <p>I am securing our our servers using password based encryption for Jboss 5.1.0.</p>
  <p>I have read the parts of the RFC:</p>
  <p><a href="https://www.rfc-editor.org/rfc/rfc2898" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc2898</a></p>
  <p>I have read the several Jboss documents several times:</p>
  <p><a href="https://docs.jboss.org/jbosssecurity/docs/6.0/security_guide/html/Encrypting_Data_Source_Passwords.html" rel="nofollow noreferrer">https://docs.jboss.org/jbosssecurity/docs/6.0/security_guide/html/Encrypting_Data_Source_Passwords.html</a> (this is for 6.0, but works with 5.1.0)</p>
  <p>Now, let me explain my issue.</p>
  <p>In the official JBoss document listed above, they treat &quot;Secured Identity&quot; encryption as if it is secure. Heck, it is in the documents. <em>Worse, I've seen other people ask questions on Stack Overflow on how to use this</em>. <strong>This is not secure</strong>. To make it secure, one has to write their own encryption class overriding org.jboss.resource.security.SecureIdentityLoginModule.</p>
  <p>I was able to prove this by doing a quick google search of &quot;Decrypt Jboss 5.1.0 Password&quot; and the first result was a jar file that decrypted Jboss passwords using the recommended approach in the official Jboss documentation.</p>
  <p>Enter Password Based Encryption.</p>
  <p>Knowing I've already found a security flaw in the first approach, I am already wearing of taking advice from this documentation-- if your wrong once, your probably wrong twice. However, it seems I don't have  I must use approach 2: Password Based Encryption.</p>
  <p>My concern is, the documentation makes me generate a 'master.password' file. I am assuming this is the derived key function mentioned in the RFC.  However, I don't know for certain.</p>
  <p>All in all, my gut tells me this:
  Your making me store a master.password on my server. The master.password file that contains the derived key function can be used by some code somewhere to simply decrypt my encrypted password. That is because I am specifying salt and iterations elsewhere in other files.</p>
  <p>This whole process seems like a mathematical function. On my end it looks like this:</p>
  <p>? = DerivedKeyFunction(Salt, Iterations, Password)</p>
  <p>But for the hacker it looks like this:</p>
  <p>EncodedPassword = DerivedKeyFunction(Salt, Iterations, ?)</p>
  <p>I'm claim to be neither a cryptographer or a Jboss expert, but my gut tells me all a hacker needs to do is look at the Jboss source code (which is open source as far as I know) and do a little bit of reverse engineering to get the password using the server.password file.</p>
  <p>So my question is: How secure is Password Based Encryption on Jboss (assuming the hacker gained access to the server)? Has anyone actually looked into this?</p>
  <p>------------ <strong>EDIT</strong> -----------------</p>
  <p>To clarify:
  This is for JBoss to connect to our Database. This is not for an end-user to log into their user account on a web application.</p>
  <p>JBoss uses a master.password (or server.password... its just a filename) which contains some sort of encrypted string. I'm not sure what's in here, its not well documented (or maybe it is and I just don't understand).</p>
  <p>After the configuration is followed, a password is never entered again. I don't see how this is secure. I'm guessing I can somehow use the server.password file created in step 1 to decrypt my database password. Someone just hasn't written a convenient jar file yet. But the code is opensource, so I'm guessing the right person knows how to do this very easily.</p>
  <p>I am sharing the steps due to the number of terrible setups I've seen people using on stack overflow. The steps are as follows:</p>
  <ol>
  <li><p>From jboss/common/lib folder, Create server.password file. place in server/conf directory.:</p>
  <pre><code> java -cp jbosssx.jar org.jboss.security.plugins.FilePassword &lt;8Charactersalt&gt; &lt;iterationsMoreThan1000&gt; &lt;aLongRandomPassword&gt; server.password
   #outputs server.password file which contains encrypted string.
  </code></pre>
  </li>
  <li><p>Encrypt Database Password</p>
  <pre><code> java -cp jbosssx.jar org.jboss.security.plugins.PBEUtils &lt;8Charactersalt&gt; &lt;iterationsMoreThan1000&gt; &lt;aLongRandomPassword&gt; &lt;databaseConnectionPassword&gt;
   #outputs encrypted DB Password
  </code></pre>
  </li>
  <li><p>Remove Username &amp; Password &amp; Update Datasource XML</p>
  <pre><code> &lt;security-domain&gt;EncryptedMySqlDbRealm&lt;/security-domain&gt;
   &lt;depends&gt;jboss.security:service=JaasSecurityDomain,domain=ServerMasterPassword&lt;/depends&gt;
  </code></pre>
  </li>
  <li><p>Add Mbean To Datasource XML. it specifies the server.password file, salt and iterations.</p>
  <p>
  
  
  </p>
     
  <p>{CLASS}org.jboss.security.plugins.FilePassword:${jboss.server.home.dir}/conf/server.password
  ${8Charactersalt}
  ${iterationsMoreThan1000}
  </p>
  </li>
  <li><p>Add Application Policy To Login Config XML. specify username, encrypted password, and datasource to encrypt. There is a 1 to 1 mapping between application policies and datasources, so if you have two datasources, it appears you need 2 application policies as well. Otherwise you get errors starting up jboss.</p>
   
     
      
        ${DatabaseUsername}
        ${EncryptedPassword}
        jboss.jca:service=LocalTxCM,name=${DataSourceNameFromDatasourceXML}
        jboss.security:service=JaasSecurityDomain,domain=ServerMasterPassword
      
     
       
  </li>
  </ol>