Java Keystore password pointless?

Question

What exactly is the sense behind a Keystore password, eg on JKS/BKS keystores?

It is obviously NOT for security, because i can open the file with an editor and copy all entries into new files without passwordcheck. Data inside a passwordprotected Keystore is not encrypted!

what does this password protect? It seems to be just for anoying developers oO...

Answer 1

let's say you saved a string called "this is my sentence" in the keystore, and when you open it by notepad, you saw cipher-text "blabla", and you copied the "blabla" to another file and claim you findout the plain-text, and it is "blabla", that is obvious incorrect, you still don't know the original pliant-ext until recover it by password.

==EDIT==

for JKS keystore, the keystore password is used to verify integrity, src

636   if (password != null) {
637       md = getPreKeyedHash(password);
638       dis = new DataInputStream(new DigestInputStream(stream, md));
639   }

the DigestInputStream generate a signature and compare it to acutal one to see if is modified.

BouncyCastle keystore UBER is more secure, the entire keystore is encrypted with a PBE based on SHA1 and Twofish (PBEWithSHAAndTwofish-CBC)

        Cipher cipher = this.makePBECipher(cipherAlg, Cipher.DECRYPT_MODE, password, salt, iterationCount);
        CipherInputStream cIn = new CipherInputStream(dIn, cipher);

        Digest dig = new SHA1Digest();
        DigestInputStream  dgIn = new DigestInputStream(cIn, dig);

        this.loadStore(dgIn);

Answer 2

On a JKS or BKS keystore the password is not pointless, but it doesn't do what you might assume, either.

It doesn't encrypt the data in the keystore or in any way prevent access to it, but it does verify the integrity of the keystore. Without knowing the password, it is not possible to make changes to a keystore without the normal user of it finding out (typically due to their tools telling them "Keystore was tampered with, or password was incorrect")

In some other keystore types (such as Keystore.BouncyCastle) the keystore password protects against inspection as well as tampering.