Merge pull request ibmruntimes#274 from KostasTsiounis/zero_out

Zero out previous key in native ChaCha20 cipher init
taoliult · Nov 9, 2023 · 3dfae78 · 3dfae78
2 parents b336934 + 1d1ad7a
commit 3dfae78
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/closed/src/java.base/share/classes/com/sun/crypto/provider/NativeChaCha20Cipher.java b/closed/src/java.base/share/classes/com/sun/crypto/provider/NativeChaCha20Cipher.java
@@ -561,6 +561,9 @@ private void init(int opmode, Key key, byte[] newNonce)
         // assigning them to the object.
         byte[] newKeyBytes = getEncodedKey(key);
         checkKeyAndNonce(newKeyBytes, newNonce);
+        if (this.keyBytes != null) {
+            Arrays.fill(this.keyBytes, (byte)0);
+        }
         this.keyBytes = newKeyBytes;
         nonce = newNonce;