I’ve just stumbled across some crypto interface code written in Java where buffers of (sensitive) data/keys are not explicitly erased (zeroed out) after use. Coming from a C programming background where explicit zeroing out of memory after use is highly recommended, I’m wondering whether this should also be done in Java. I understand that it’s impossible to guarantee efficient erasure of all possible instances of a data object in Java.

I’m seeing two contradictory arguments here:
•     Explicit zeroing out of a memory object after use may considerably reduce, ideally eliminate  the likelihood/number of remaining object instances with the original content.
•     Explicit zeroing out (i.e. alteration) of a memory object may cause the memory manager to explicitly create a new (additional) copy of the original content. Hence, this action would not catch the initial instance of the data abject, but only create additional overhead.

Does it make sense to distinguish between "simple" data types (e.g. an int array with constant size) and "complex" data types (e.g. a string object)? Do you know of any good research or reference about this? I haven’t found anything well investigated in the Internet. Both arguments exist.

Thanks, Michael