At 06:51 AM 15/07/98 +0100, you wrote:
>> We want to use JDBC together with a patched PostgreSQL using Brett
>> McCormick's PostgreSQl-SSL patch. Is it possible to use encrypted
>> communication with JDBC using this? Or kerberos? Or do you have any
>> suggestions as to how we can make it secure?
>
>Currently there is no way of encrypting the data stream using SSL or
>Kerberos - yet. The java.security api may help us in the near future.
The article "JBDC Drivers and Web Security" by Mukul Sood in Dr. Dobb's Journal (July 1998) discusses this a bit and
somesolutions that currently exist. A discussion about the use of SSL in JBDC solutions is included. In addition, three
ofthe driver venders considered in the latter part of the article make use of SSL.
As Sood says "any program that makes use of TCP can be modified to use SSL connections". Several of the driver venders
makeuse of this by providing encryption and authentification services to network applications (including Java applets
andapplications using JDBC) using SSL.
For a good example of this, read the section in the article on WebLogic's Tengah/JBDC, which uses RSA SSL.
>The only encoding possible so far is using the crypt authentication
>system, where the password is sent over the wire encrypted. We can handle
>this, as we have our own copy of crypt in the driver.
Peter or somebody, could you point me to an example of how this is used? Thanks.
Andrew