I am working on an applet which has to share some keys of type AESKey with different terminals. The thing is I don't know in advance how many terminals it will have to handle.
As there is no structure like HashTable in Java Card, it's getting complicated. I can still fix an upper bound and instanciate as much objects AESKey but I would like to search for another way to do.
I thought I could do something with byte arrays, but is it a bad practice to store keys in byte[]?
I think the answer is yes and it is only recommanded to store it in transient arrays to make computations. Otherwise, I don't understand the role of AESKey objects. Just want to be sure.
Important security-relevant data like keys and PINs shall always be stored in the therefore designated objects from the Javacard API, e.g. AESKey.
The smartcard operating system will perform additional internal operations to protect there values from leaking.
If you don't know how many terminals the card will encounter you could encapsulate the Keys in an Object which is part of a linked list:
class KeyElement{
KeyElement next;
AESKey key;
}