Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
secure erasure of Java key/password buffers
17 views
Skip to first unread message
mortadelo
Jul 16, 2012, 4:15:01 AM7/16/12
to
Hi everybody,
I’ve just stumbled across some crypto interface code written in Java where buffers of (sensitive) data/keys are not explicitly erased (zeroed out) after use. Coming from a C programming background where explicit zeroing out of memory after use is highly recommended, I’m wondering whether this should also be done in Java. I understand that it’s impossible to guarantee efficient erasure of all possible instances of a data object in Java.
I’m seeing two contradictory arguments here:
• Explicit zeroing out of a memory object after use may considerably reduce, ideally eliminate the likelihood/number of remaining object instances with the original content.
• Explicit zeroing out (i.e. alteration) of a memory object may cause the memory manager to explicitly create a new (additional) copy of the original content. Hence, this action would not catch the initial instance of the data abject, but only create additional overhead.
Does it make sense to distinguish between "simple" data types (e.g. an int array with constant size) and "complex" data types (e.g. a string object)? Do you know of any good research or reference about this? I haven’t found anything well investigated in the Internet. Both arguments exist.
Thanks, Michael
I’ve just stumbled across some crypto interface code written in Java where buffers of (sensitive) data/keys are not explicitly erased (zeroed out) after use. Coming from a C programming background where explicit zeroing out of memory after use is highly recommended, I’m wondering whether this should also be done in Java. I understand that it’s impossible to guarantee efficient erasure of all possible instances of a data object in Java.
I’m seeing two contradictory arguments here:
• Explicit zeroing out of a memory object after use may considerably reduce, ideally eliminate the likelihood/number of remaining object instances with the original content.
• Explicit zeroing out (i.e. alteration) of a memory object may cause the memory manager to explicitly create a new (additional) copy of the original content. Hence, this action would not catch the initial instance of the data abject, but only create additional overhead.
Does it make sense to distinguish between "simple" data types (e.g. an int array with constant size) and "complex" data types (e.g. a string object)? Do you know of any good research or reference about this? I haven’t found anything well investigated in the Internet. Both arguments exist.
Thanks, Michael
0 new messages