Key store on JNDI ?

Question

Hi,
I develop application working inside application serwer (JBoss 4). The application has functionality that requires usage of kryptographic keys for signing and decrypting data.
My question is about concurrent access to such keystore, under heavy load, one key may be accessed from many threads. how to deal with it ? Would it be good solution to put keystore object on JNDI and retrieve it every time it should be used ?
regards,
Martin

Answer 1

Hi there Martin,
Your concerns about keystores are valid, though technically, you can setup the keystore as a physical file and have each thread request the keys. I know that under heavy loads, this isn't really that much of a problem, as each thread is technically doing a READ of the file, and not locking it. The problem comes in when you need to either delete or add a new key to that keystore. These both require a WRITE lock, and as this is file IO, you will get locking errors.
I came up with a solution (which I just finished implementing/testing about 20 minutes ago :) ) wherin you store each key within it's own keystore, and then store that keystore under the alias's name in a database table - using varbyte datatype - because you can keystore.store(ByteArrayOutputStream, passwordChars) and then store that to a DB row.
This gives me an average column size of around 1500 bytes for each keystore. Not only that, but when I need to add/remove certs, it's a database call, which handles read/write locks well, and once done, allows the other threads to continue. Not only that, but you can cache that table, and maybe even JNDI it as you asked.
Hope this gives you a bit of help.