如何在java中将密钥归零?

2022-01-10 00:00:00 cryptography security android secret-key java

以下java代码是否足以清除内存中的密钥(将其所有字节值设置为0)?

Is the following java code sufficient for clearing the secret key in memory (setting all of its byte value to 0)?

zerorize(SecretKey key)
{
    byte[] rawKey = key.getEncoded();
    Arrays.fill(rawKey, (byte) 0);
}

换句话说，getEncoded 方法是否返回对实际键的副本或引用?如果返回副本，作为安全措施，如何清除密钥?

In other words, does the getEncoded method return a copy or reference to the actual key? If a copy is returned, then how can I clear the secret key as a security measure?

推荐答案

在尝试清除密钥之前，您应该先检查 SecretKey 接口的实现是否也实现了 javax.security.auth.Destroyable 接口.如果是这样，当然更喜欢.

Before trying to clear the key, you should check first if the implementation of the SecretKey interface also implements the javax.security.auth.Destroyable interface. If so, prefer that of course.

相关文章