title: Where do you store your secret key in a Java Web Application?
body: <p>Cryptography is a widely adopted techonlogy to ensure confidentiality. Not considering implementation flaws, it has a single critical point: <em>the secret key storage</em>. If the secret key is stolen, the whole system will be compromised.</p>
  
  <p><strong>EDIT :</strong></p>
  
  <p>let me specify the context to make the question less broad:</p>
  
  <ol>
  <li>here a java web application is addressed</li>
  <li>more specifically it is used the spring framework version 3</li>
  <li>spring security 3.1 is used to secure the application</li>
  <li>a mysql5 database is available</li>
  <li>the application server is tomcat6 or tomcat7</li>
  <li>the server machine is <strong>not</strong> under my control</li>
  </ol>
  
  <p>Maybe the questions can be focused on this scenario but, as pointed out, the problem of the secret key storage is transversal to the adopted technologies. However some libraries might offer peculiar features that can somehow facilitate the work.
  A clear point is that a tradeoff has to be found between security and the need to do practical things. To complete the analysis it is obvious that the required security level depends on the value of information to secure. It is senseless to flip our minds to enforce super-secure strategies (demanding a very lot of efforts) to keep secret the shoe size of a customer.</p>
  
  <p>Here, I have to secure an email password (that will be stored in a db). I consider this information average critical.</p>
  
  <p>What I'm looking for here, is the best solution with reasonable effort.</p>
  
  <p>So the question is very clear: <strong>where would you store this information?</strong></p>
  
  <ol>
  <li>do you store it in a database? So it should be encrypted and this requires another key (and where do you store this second key?)</li>
  <li>do you store it inside the <code>.war</code> package? How do you prevent unauthorized accesses to the sources?</li>
  <li>do you adopt a different strategy?</li>
  </ol>
  
  <p>motivations for your strategy will be appreciated.
  thank you</p>