Package co.ankatech.ankasecure.keymanagement.security

Class Zeroization

java.lang.Object
co.ankatech.ankasecure.keymanagement.security.Zeroization
public final class Zeroization extends Object
Centralized zeroization helpers for the ANKASecure Key Management SDK secure-memory layer.

All buffers passed in are overwritten in place using Arrays.fill(byte[], byte) and Arrays.fill(char[], char), which is the only portable mechanism available on the JVM. JIT register spills, JVM string interning, and library-internal pools are NOT addressed by these methods.

  • Method Details

    • zeroize

      public static void zeroize(byte[] buf)
      Overwrites every element with 0x00. Null-safe (no-op on null).
      Parameters:
      buf - the buffer to zeroize; may be null

    • zeroize

      public static void zeroize(char[] buf)
      Overwrites every element with the space character ' '. Null-safe (no-op on null).

      Space-fill (rather than 0x00) is a deliberate choice: spaces are visible in heap dumps as printable text, making accidental retention easier to spot during forensic analysis. The security guarantee is identical — the original sensitive content is replaced.

      Parameters:
      buf - the buffer to zeroize; may be null

    • destroyIfPossible

      public static void destroyIfPossible(Object obj)
      Calls Destroyable.destroy() if the supplied object implements Destroyable and is not yet destroyed. Swallows DestroyFailedException, which the JDK throws by default for SecretKeySpec and several library types.

      Null-safe: passing null is a no-op.

      Parameters:
      obj - the object to destroy if possible; may be null