JCE: zero encodedKey buffer in DH/EC/RSA Key Factories before returning

Author: rlm2002

src/main/java/com/wolfssl/provider/jce/WolfCryptDHKeyFactory.java

@@ -440,7 +440,9 @@ private <T extends KeySpec> T getPrivateKeySpec(DHPrivateKey key,
                     throw new InvalidKeySpecException(
                         "DHPrivateKey.getEncoded() returned null");
                 }
-                return (T) new PKCS8EncodedKeySpec(encoded);
+                T pkcs8EncKS = (T) new PKCS8EncodedKeySpec(encoded);
+                Arrays.fill(encoded, (byte)0);
+                return pkcs8EncKS;
             }
             else if (keySpec.isAssignableFrom(DHPrivateKeySpec.class)) {
                 /* Extract private value and params directly from key */
@@ -542,6 +544,8 @@ private PrivateKey translatePrivateKey(DHPrivateKey key)
             }
 
             keySpec = new PKCS8EncodedKeySpec(encoded);
+            Arrays.fill(encoded, (byte)0);
+
             return engineGeneratePrivate(keySpec);
 
         } catch (InvalidKeySpecException e) {

src/main/java/com/wolfssl/provider/jce/WolfCryptECKeyFactory.java

@@ -653,7 +653,10 @@ private <T extends KeySpec> T getPrivateKeySpec(ECPrivateKey key,
                     throw new InvalidKeySpecException(
                         "ECPrivateKey.getEncoded() returned null");
                 }
-                return (T) new PKCS8EncodedKeySpec(encoded);
+                T pkcs8EncKS = (T) new PKCS8EncodedKeySpec(encoded);
+                Arrays.fill(encoded, (byte)0);
+
+                return pkcs8EncKS;
             }
             else if (keySpec.isAssignableFrom(ECPrivateKeySpec.class)) {
                 /* Extract private value and params directly from key */
@@ -748,6 +751,8 @@ private PrivateKey translatePrivateKey(ECPrivateKey key)
             }
 
             PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(encoded);
+            Arrays.fill(encoded, (byte)0);
+
             return engineGeneratePrivate(keySpec);
 
         } catch (InvalidKeySpecException e) {

src/main/java/com/wolfssl/provider/jce/WolfCryptRSAKeyFactory.java

@@ -534,7 +534,10 @@ private <T extends KeySpec> T getPrivateCrtKeySpec(RSAPrivateCrtKey key,
                     throw new InvalidKeySpecException(
                         "RSAPrivateCrtKey.getEncoded() returned null");
                 }
-                return (T) new PKCS8EncodedKeySpec(encoded);
+                T pkcs8EncKS = (T) new PKCS8EncodedKeySpec(encoded);
+                Arrays.fill(encoded, (byte)0);
+
+                return pkcs8EncKS;
             }
             else if (keySpec.isAssignableFrom(RSAPrivateCrtKeySpec.class)) {
                 /* Extract CRT parameters directly from key */
@@ -600,7 +603,10 @@ private <T extends KeySpec> T getPrivateKeySpec(RSAPrivateKey key,
                     throw new InvalidKeySpecException(
                         "RSAPrivateKey.getEncoded() returned null");
                 }
-                return (T) new PKCS8EncodedKeySpec(encoded);
+                T pkcs8EncKS = (T) new PKCS8EncodedKeySpec(encoded);
+                Arrays.fill(encoded, (byte)0);
+
+                return pkcs8EncKS;
             }
             else if (keySpec.isAssignableFrom(RSAPrivateKeySpec.class)) {
                 /* Extract basic private key parameters */
@@ -705,6 +711,7 @@ private PrivateKey translatePrivateKey(RSAPrivateKey key)
             }
 
             keySpec = new PKCS8EncodedKeySpec(encoded);
+            Arrays.fill(encoded, (byte)0);
 
             return engineGeneratePrivate(keySpec);