JDK-8008795 : Clean memory in JCE implementations of private key and secret key
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.crypto
  • Affected Version: 8
  • Priority: P3
  • Status: Closed
  • Resolution: Won't Fix
  • Submitted: 2013-02-25
  • Updated: 2019-05-15
  • Resolved: 2019-05-15
Related Reports
Duplicate :  
JDK-8158824 - sun.security.rsa.RSAPrivateCrtKeyImpl & RSAPrivateKeyImpl should provide destroy() and isDestroyed() implementations
Relates :  
JDK-8160206 - SecretKeySpec should implement destroy()
Description
The java.security.PrivateKey and javax.crypto.SecretKey classes extend the javax.security.auth.Destroyable interface (since JDK-6263419)

Modify implementation classes in JCE to make use of the Destroyable interface by zeroing sensitive
key material when it is no longer required.
Comments
[~mduigou] Adam's previous explanation was unintentionally marked Confidential. Here is his explanation: "Clearing the buffer doesn't fully solve the problem, since the secret could have been copied to other places in memory by the JVM. So we would need support from the JVM to zeroize secrets. If that support is added, then we can revisit issues like this one."
15-05-2019
Closed with no explanation?
16-04-2019