Derby
  1. Derby
  2. DERBY-962

Upgrade default security mechanism in client to use encrypted userid password if client can support it.

    Details

    • Type: Improvement Improvement
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 10.2.1.6
    • Component/s: Network Client
    • Labels:
      None

      Description

      Currently in the client, if userid and password are set in the connection url, the default security mechanism is upgraded to USRIDPWD (which is clear text userid and password). This seems to be a security hole here.

      Current client driver supports encrypted userid/password (EUSRIDPWD) via the use of DH key-agreement protocol - however current Open Group DRDA specifications imposes small prime and base generator values (256 bits) that prevents other JCE's (apt from ibm jce) to be used as java cryptography providers.

      Some thoughts:
      – client can make a check to see if it the jvm it is running in supports the encryption necessary for EUSRIDPWD. If it supports, then the client can upgrade to EUSRIDPWD.
      – if the jvm the client is running is , doesnt support encryption requirements for EUSRIDPWD, then the security mechanism will be set to USRIDPWD.

      DERBY-528 will add support for strong userid and password which is another option to send encrypted passwords across the wire. When this gets added, maybe this can be considered as one of the upgrade options after EUSRIDPWD.

      1. d962_javadoc.2.diff.txt
        1 kB
        Sunitha Kambhampati
      2. d962_javadoc.diff.txt
        1 kB
        Sunitha Kambhampati
      3. Derby962.diff.txt
        140 kB
        Sunitha Kambhampati
      4. Derby962.stat.txt
        0.8 kB
        Sunitha Kambhampati
      5. Derby962_forreview.diff.txt
        137 kB
        Sunitha Kambhampati
      6. Derby962_forreview.stat.txt
        0.8 kB
        Sunitha Kambhampati
      7. 962_table.txt
        5 kB
        Sunitha Kambhampati

        Issue Links

          Activity

            People

            • Assignee:
              Sunitha Kambhampati
              Reporter:
              Sunitha Kambhampati
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development