Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying do draft up a secure way to encrypt (on the fly, invoking it from an app) and decrypt sensible information (credit cards) using AES-256.

The target platform is:

cat /etc/release

Solaris 10 10/09 s10s_u8wos_08a SPARC

The optimal solution would be to be able to save the keys inside a Key Store, and use encrpyt/decrypt (paired with UUENCODE so that the resulting encrypted string can be saved inside a normal DB field).

We have succesfully tested the whole chain using just AES-128 (out-of-the-box with a basic Solaris install) and we understand we need to upgrade the target env. with the correct Solaris package to get to AES-256 [SUNWcry package - the unbundled Solaris Data Encryption Kit].

What escapes me is how to make "encrypt" access a key from the keystore. Oracle documentation mentions "-K" as a command line parameter (note this is an uppercase K) to do this (see here, for example), but the "-K" switch seems not to be available on our test machine.

Is this possible? Is this linked to the specific Solaris version? If not, can we obtain this by installing something else? (We haven't yet installed the crypto package to get to AES-256 so no idea if this will come "for free" with that).

share|improve this question
    
We can consider this closed: Oracle finally answered and apparently this can only work in Solaris 11 and there is no additional packaging that can do the same for Solaris 10. Bummer. :( –  p.marino Nov 2 '11 at 11:35

1 Answer 1

I saw the comment that said this issue was closed for you, but I felt compelled to reach out to another Solaris user.

The encrypt and decrypt commands are provided by the SUNWcsu package, not the SUNWcrypt package.

The -K option comes in Solaris 11.

Another option for you might be to roll your own solution, if you can write code. here's an example:

http://blogs.oracle.com/sprack/entry/using_solaris_softtoken_keystore

Or use another solution as well, based on an encrypted ZFS filesystem to protect either the keystore or the data, or both. here's an example of that:

http://www.c0t0d0s0.org/archives/7055-Protecting-your-data-with-two-factors-and-ZFS-dataset-encryption.html

If you stored the encrypt/decrypt key (-k key, not -K keystore) on an encrypted filesystem, your application stack could use the current encrypt/decrypt binaries to do your work.

Or, just roll out Solaris 11, which drops GA next week. :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.