Separate Crypto Related Properties into Separate File about owasp-esapi-java

[GoogleCodeExporter]

As an abosolute minimum, Encryptor.MasterKey and Encryptor.MasterSalt should be 
moved
to a separate file (e.g., something like ESAPI-Encryptor.properties or
Encryption.properties) because these properties need to be kept secret to all 
but a
small set of individuals. For instance, in a production environment, developers
should not even have read access to these properties, however it is probably 
that
they have read access to the other encryption-related properties such as 

Original comment by [email protected] on 7 Nov 2009 at 5:47

[GoogleCodeExporter]

Although one could override the DefaultSecurityConfiguration and point to 
another
file that includes those two properties, I think this desire would be 
commonplace and
this feature should be part of the default implementation.  I would also 
suggest a
separate system property be defined which could point to the path of the new
ESAPI-Encryptor.properties file so that it can reside outside the default .esapi
"org.owasp.esapi.resources" directory if desired to make it easier to protect 
using
tighter file access controls, auditing, and backup procedures during deployment.

Original comment by [email protected] on 8 Nov 2009 at 4:17

[GoogleCodeExporter]

We need to abstract the entire key management process. I agree with all 
thoughts above.

Original comment by [email protected] on 1 Nov 2010 at 6:02

• Changed state: Accepted
• Added labels: Milestone-Release2.1