From 09b4f716ca2676594ebf1944f2ff9fd093797a34 Mon Sep 17 00:00:00 2001 From: Fabian Henneke Date: Thu, 25 Jun 2020 15:21:55 +0200 Subject: [PATCH] Clear passphrase bytes after use Mimics the behavior of `decrypt()` in `PKCS5KeyFile.java`. --- .../sshj/userauth/keyprovider/OpenSSHKeyV1KeyFile.java | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyV1KeyFile.java b/src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyV1KeyFile.java index d71a5421a..cb8949f73 100644 --- a/src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyV1KeyFile.java +++ b/src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyV1KeyFile.java @@ -143,9 +143,12 @@ private void initializeCipher(String kdfName, byte[] kdfOptions, Cipher cipher) CharBuffer charBuffer = CharBuffer.wrap(pwdf.reqPassword(null)); ByteBuffer byteBuffer = Charset.forName("UTF-8").encode(charBuffer); passphrase = Arrays.copyOfRange(byteBuffer.array(), byteBuffer.position(), byteBuffer.limit()); + Arrays.fill(charBuffer.array(), '\u0000'); + Arrays.fill(byteBuffer.array(), (byte) 0); } byte[] keyiv = new byte[48]; new BCrypt().pbkdf(passphrase, opts.readBytes(), opts.readUInt32AsInt(), keyiv); + Arrays.fill(passphrase, (byte) 0); byte[] key = Arrays.copyOfRange(keyiv, 0, 32); byte[] iv = Arrays.copyOfRange(keyiv, 32, 48); cipher.init(Cipher.Mode.Decrypt, key, iv);