How to scrub PrivateKey data from memory after using it?

Question

Is there a way to delete the sensitive information from a PrivateKey out of the memory? (Without hoping for the Garbage Collector to clean up ?)

Do I have to write my own implementation of PrivateKey
or
Is there something already that i could use?

Answer 1

You have to make sure that none of the sensitive data is put into an immutable data type (e.g., you cannot use String), because when you are done with the sensitive data, you need to be able to overwrite it.

You will probably keep the meat of the private key in a byte array (since this is exactly what getEncoded() returns). When you are done with the private key, fill the byte array with zeros (or whatever).

You may need to implement your own version of PrivateKey, so you can add this new functionality (because you cannot guarantee that the provided implementation returns an alias to the actual array rather than a copy).

You also need to worry about any callers of getEncoded(), because the caller could keep a copy of the data.

Answer 2

You cannot do this within regular Java without going native. The JVM can always copy the data and the RSAPrivateKey interface specifies getPrivateExponent() to return an immutable BitInteger instance. This is used by the Cipher and Signature classes. Using a secure token (e.g. using the Sun PKCS#11 provider) is the best way to go.

There are serious issues by using decryption or signing in software if you don't think that the memory can be kept safe, whatever you do. You require at least operating system level support, which is not something that is enabled within Oracle Java implementations.