Security recommendation according to https://heise.de/-4211551

udamken · Apr 21, 2019 · 7af20ac · 7af20ac
1 parent ea92b73
commit 7af20ac
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/PswGenCore/src/main/java/de/dknapps/pswgencore/util/EncryptionHelper.java b/PswGenCore/src/main/java/de/dknapps/pswgencore/util/EncryptionHelper.java
@@ -115,9 +115,10 @@ public EncryptionHelper(final char[] passphrase, final String saltAsHexString,
 		try {
 			salt = EncryptionHelper.toByteArray(saltAsHexString);
 			initializer = EncryptionHelper.toByteArray(initializerAsHexString);
-			KeySpec keySpec = new PBEKeySpec(passphrase, salt, KEY_ITERATION_COUNT, KEY_LENGTH);
+			PBEKeySpec keySpec = new PBEKeySpec(passphrase, salt, KEY_ITERATION_COUNT, KEY_LENGTH);
 			SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance(SECRET_KEY_FACTORY_ALGORITHM);
 			SecretKey secretKey = secretKeyFactory.generateSecret(keySpec);
+			keySpec.clearPassword(); // see https://heise.de/-4211551
 			cipher = Cipher.getInstance(CIPHER_TRANSFORMATION);
 			SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey.getEncoded(), CIPHER_ALGORITHM);
 			cipher.init(Cipher.DECRYPT_MODE, secretKeySpec, new IvParameterSpec(initializer));