Menu

#39 Should PBEKeySpec#clearPassword be invoked in StandardPBEByteEncryptor#initialize?

v1.9.x
open
nobody
None
3
2015-02-25
2015-02-25
eiden
No

In StandardPBEByteEncryptor#initialize great care is taken to clear the password char[] array.

On line 666 an instance of PBEKeySpec is created:
final PBEKeySpec pbeKeySpec = new PBEKeySpec(normalizedPassword);

Would it be a good idea to call PBEKeySpec#clearPassword() on this after the calls to factory#generateSecret has completed?

Discussion


Log in to post a comment.

MongoDB Logo MongoDB