Keys under doormats: Problems and Solutions for Securely Storing Credentials in Web Apps using Key Encrypting Key (KEK)

Encryption keys and passwords are “keys to the kingdom.” Acquiring them allows attackers to open all kinds of doors, and yet developers are often careless. As a result, keys fall victim to reverse engineering and software vulnerabilities such as Path Traversal, XML External Entities (XXE), Local File Inclusion, and others. Ron will review the most common methods of storing credentials and best practices for storing them, such as using key stores.

However, an important issue remains — how do you secure the Master Key? The security of this “key that secures other keys” or the Key Encrypting Key (KEK) is critical. Ron will discuss several low cost, preferred ways for securely storing KEKs, from hardware to software, and their relative costs, including a novel approach that is resistant to remote attacks up to and including path traversal vulnerabilities.