HmacPKCS12PBESHA1.java:
76 byte[] passwdBytes = key.getEncoded();
77 if ((passwdBytes == null) ||
78 !(key.getAlgorithm().regionMatches(true, 0, "PBE", 0, 3)))
{
79 throw new InvalidKeyException("Missing password");
80 }
Please also cleanup passwdBytes. Maybe divide the if check above into 2 to
avoid passwdBytes being assigned but algorithm is not PBE.
132 Arrays.fill(passwdChars, '0');
In a finally block?
PBES1Core.java:
250 Arrays.fill(passwdBytes, (byte) 0x00);
In a finally block?
PBES2Core.java:
273 Arrays.fill(passwdChars, ' ');
274 Arrays.fill(passwdBytes, (byte)0x00);
In a finally block?
PBKDF2KeyImpl.java:
88 if (passwd == null) {
89 // Should allow an empty password.
90 this.passwd = new char[0];
91 } else {
92 this.passwd = passwd.clone();
93 }
94 // Convert the password from char[] to byte[]
95 byte[] passwdBytes = getPasswordBytes(this.passwd);
96 // remove local copy
97 Arrays.fill(passwd, '0');
Strange, why passwd.clone()?
129 Arrays.fill(passwdBytes, (byte)0x00);
In a finally block?
PBMAC1Core.java:
111 byte[] passwdBytes = key.getEncoded();
112 if ((passwdBytes == null) ||
113 !(key.getAlgorithm().regionMatches(true, 0, "PBE", 0, 3)))
{
114 throw new InvalidKeyException("Missing password");
115 }
170 Arrays.fill(passwdChars, ' ');
Same comments as for HmacPKCS12PBESHA1.java.
PKCS12PBECipherCore.java:
262 char[] passwdChars = null;
Deal with the same way as in PBMAC1Core.java?
MD4.java:
110 void implReset() {
Add @Override.
Thanks
Max
> On Aug 9, 2018, at 6:42 PM, Seán Coffey <sean.cof...@oracle.com> wrote:
>
> Adding RFR to title..
>
> On 09/08/2018 11:37, Seán Coffey wrote:
>> I've been looking further at how private/temporary buffers are used in
>> cipher/keystore management and identified some more areas that could benefit
>> with a more aggressive nulling out of contents.
>>
>> I've been testing through use of stepping through debugging sessions while
>> setting/getting keys and capturing process memory via tooling like gcore.
>>
>> JBS report : https://bugs.openjdk.java.net/browse/JDK-8209129
>>
>> webrev :
>> http://cr.openjdk.java.net/~coffeys/webrev.8209129.v1/webrev/index.html
>>
>> TCK and regression tests are green.
>>
>> regards,
>> Sean.
>>
>
