File encryption using jar - ERP -Linux

[satish]

Dear erman,

We are on RHEL 7.9

I am an ERP DBA and need your expertise. Requirement is to encrypt  a file and  push it to bank server.

Manual encryption will be done by placing the jar file & the file to be encrypted on a physical path and the same need to achieved using shell script in Linux which will be later called by a concurrent program  to encrypt the file automatically instead of manual.

 We have 2 options:


 1) Jar file will be provided by bank and using this jar, we have to encrypt our file and push to bank. we need not generate any key from our end,as the key is included in jar file itself which will provided by bank.

Command like:

java –jar  <<name of jar file>>.jar  <<full path of the file>>

2) We have to generate a key using a command along with the jar file(which will be provided by bank). We have to hardcode the generated key in shell script,and use it to encrypt the file and push to bank server

Command like:

For key generation:

Java -jar <<name of jar file>>.jar  E

For encryption:

java –jar  <<name of jar file>>.jar  <<full path of the file>>  <<key>>



Which of the above is secured and need your recommendation?
Is it recommended to generate the key using jar file  and hardcode the key in shell script OR asking bank to provide the key included in jar file itself?

Option 1 or Option 2

All of the banks chosen option 1.But an upcoming bank chosen option 2,the reason they said is,

Encryption key is a public key,we cannot hard code in .jar file and any change in .jar file is not possible,since same is used by multiple customer for host to host channel.



Thanks,
SG

[ErmanArslansOracleBlog]

In my opinion, both of the options gives you a secure way for your file transfer operations.
But I didn't catch the point in the following comment from the bank: "Encryption key is a public key,we cannot hard code in .jar file and any change in .jar file is not possible, since same is used by multiple customer for host to host channel."

The public key is something that is available for anyone to use. So I didn't understand what they meant by "the same is used by multiple customers"

Probably, they don't want to change their jar file.. They do not have that public key in it, and they don't want to include it and change their jar file, that's their stance on this.

So if not possible, then you will go with what is possible..