Zero out previous key in native ChaCha20 cipher init

ibmruntimes · Oct 19, 2023 · 1d1ad7a · 1d1ad7a
1 parent f215a7e
commit 1d1ad7a
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/closed/src/java.base/share/classes/com/sun/crypto/provider/NativeChaCha20Cipher.java b/closed/src/java.base/share/classes/com/sun/crypto/provider/NativeChaCha20Cipher.java
@@ -561,6 +561,9 @@ private void init(int opmode, Key key, byte[] newNonce)
         // assigning them to the object.
         byte[] newKeyBytes = getEncodedKey(key);
         checkKeyAndNonce(newKeyBytes, newNonce);
+        if (this.keyBytes != null) {
+            Arrays.fill(this.keyBytes, (byte)0);
+        }
         this.keyBytes = newKeyBytes;
         nonce = newNonce;