問題描述
以下java代碼是否足以清除內(nèi)存中的密鑰(將其所有字節(jié)值設(shè)置為0)?
Is the following java code sufficient for clearing the secret key in memory (setting all of its byte value to 0)?
zerorize(SecretKey key)
{
byte[] rawKey = key.getEncoded();
Arrays.fill(rawKey, (byte) 0);
}
換句話說，getEncoded 方法是否返回對實(shí)際鍵的副本或引用?如果返回副本，作為安全措施，如何清除密鑰?
In other words, does the getEncoded method return a copy or reference to the actual key? If a copy is returned, then how can I clear the secret key as a security measure?
推薦答案
在嘗試清除密鑰之前，您應(yīng)該先檢查 SecretKey 接口的實(shí)現(xiàn)是否也實(shí)現(xiàn)了 javax.security.auth.Destroyable 接口.如果是這樣，當(dāng)然更喜歡.
Before trying to clear the key, you should check first if the implementation of the SecretKey interface also implements the javax.security.auth.Destroyable interface. If so, prefer that of course.
這篇關(guān)于如何在java中將密鑰歸零?的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網(wǎng)！