0

Imagine you have a symmetric key in heap memory, you no longer need it but you want to make sure it is wiped before the memory is released/garbage collected. If you wipe it yourself, the optimiser is likely to skip this step as unnecessary. So, how to do it properly?

user1081596
  • 917
  • 1
  • 9
  • 16
  • 1
    http://stackoverflow.com/questions/8881291/why-is-char-preferred-over-string-for-passwords – Louis Wasserman Mar 27 '12 at 14:57
  • Basically impossible to do securely, the thing about using a char array is basically a red herring (a single GC happens before you clear it and suddenly you have 2 copies in memory.. oops). The only guaranteed to work way is to use a DirectByteBuffer, but that's a lot of hassle. I've used unsafe to create String instances outside the GC heap for fun in the past but that's fragile for obvious reasons. – Voo Mar 27 '12 at 20:11

1 Answers1

0

I think this blog post should get you started. It seems to be about Swing, but I don't see why you couldn't apply it generally.

http://www.javalobby.org/java/forums/t19519.html

jefflunt
  • 33,527
  • 7
  • 88
  • 126