Zero private key bytes on release

Author: JeremiahM37

native/com_wolfssl_WolfSSLCRL.c

@@ -368,14 +368,15 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCRL_X509_1CRL_1sign
     const WOLFSSL_EVP_MD* md = NULL;
     unsigned char* rsaPrivBuf = NULL;
     const char* mdName = NULL;
+    jboolean isCopy = JNI_FALSE;
     int ret = WOLFSSL_SUCCESS;
     (void)jcl;
 
     if (jenv == NULL || crl == NULL || keyBytes == NULL) {
         return WOLFSSL_FAILURE;
     }
 
-    keyBuf = (byte*)(*jenv)->GetByteArrayElements(jenv, keyBytes, NULL);
+    keyBuf = (byte*)(*jenv)->GetByteArrayElements(jenv, keyBytes, &isCopy);
     if ((*jenv)->ExceptionOccurred(jenv)) {
         (*jenv)->ExceptionClear(jenv);
         return WOLFSSL_FAILURE;
@@ -471,6 +472,15 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCRL_X509_1CRL_1sign
         (*jenv)->ReleaseStringUTFChars(jenv, digestAlg, mdName);
     }
     if (keyBuf != NULL) {
+        /* Only zero if JVM made a copy */
+        if (isCopy == JNI_TRUE) {
+        #if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && \
+            !defined(WOLFSSL_NO_FORCE_ZERO)
+            wc_ForceZero(keyBuf, keySz);
+        #else
+            XMEMSET(keyBuf, 0, keySz);
+        #endif
+        }
         (*jenv)->ReleaseByteArrayElements(jenv, keyBytes, (jbyte*)keyBuf,
             JNI_ABORT);
     }

native/com_wolfssl_WolfSSLCertRequest.c

@@ -247,6 +247,7 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCertRequest_X509_1REQ_1sign
     const WOLFSSL_EVP_MD* md = NULL;
     unsigned char* rsaPrivBuf = NULL;
     const char* mdName = NULL;
+    jboolean isCopy = JNI_FALSE;
     int ret = WOLFSSL_SUCCESS;
     (void)jcl;
 
@@ -255,7 +256,7 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCertRequest_X509_1REQ_1sign
         return WOLFSSL_FAILURE;
     }
 
-    keyBuf = (byte*)(*jenv)->GetByteArrayElements(jenv, keyBytes, NULL);
+    keyBuf = (byte*)(*jenv)->GetByteArrayElements(jenv, keyBytes, &isCopy);
     keySz = (*jenv)->GetArrayLength(jenv, keyBytes);
 
     if (keyBuf == NULL || keySz == 0) {
@@ -343,6 +344,15 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCertRequest_X509_1REQ_1sign
         XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
     if (keyBuf != NULL) {
+        /* Only zero if JVM made a copy */
+        if (isCopy == JNI_TRUE) {
+        #if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && \
+            !defined(WOLFSSL_NO_FORCE_ZERO)
+            wc_ForceZero(keyBuf, keySz);
+        #else
+            XMEMSET(keyBuf, 0, keySz);
+        #endif
+        }
         (*jenv)->ReleaseByteArrayElements(jenv, keyBytes,
             (jbyte*)keyBuf, JNI_ABORT);
     }

native/com_wolfssl_WolfSSLCertificate.c

@@ -888,6 +888,7 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1sign
     const WOLFSSL_EVP_MD* md = NULL;
     unsigned char* rsaPrivBuf = NULL;
     const char* mdName = NULL;
+    jboolean isCopy = JNI_FALSE;
 
     int ret = WOLFSSL_SUCCESS;
     (void)jcl;
@@ -897,7 +898,7 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1sign
         return WOLFSSL_FAILURE;
     }
 
-    fileBuf = (byte*)(*jenv)->GetByteArrayElements(jenv, fileBytes, NULL);
+    fileBuf = (byte*)(*jenv)->GetByteArrayElements(jenv, fileBytes, &isCopy);
     fileSz = (*jenv)->GetArrayLength(jenv, fileBytes);
 
     if (fileBuf == NULL || fileSz == 0) {
@@ -990,6 +991,15 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1sign
         XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
     if (fileBuf != NULL) {
+        /* Only zero if JVM made a copy */
+        if (isCopy == JNI_TRUE) {
+        #if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && \
+            !defined(WOLFSSL_NO_FORCE_ZERO)
+            wc_ForceZero(fileBuf, fileSz);
+        #else
+            XMEMSET(fileBuf, 0, fileSz);
+        #endif
+        }
         (*jenv)->ReleaseByteArrayElements(jenv, fileBytes,
             (jbyte*)fileBuf, JNI_ABORT);
     }

src/java/com/wolfssl/WolfSSLCRL.java

@@ -28,6 +28,7 @@
 import java.nio.charset.StandardCharsets;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
+import java.util.Arrays;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.Locale;
@@ -561,9 +562,13 @@ else if (key instanceof ECPrivateKey) {
                 "PrivateKey does not support encoding");
         }
 
-        synchronized (crlLock) {
-            ret = X509_CRL_sign(this.crlPtr, evpKeyType, encodedKey,
-                WolfSSL.SSL_FILETYPE_ASN1, digestAlg);
+        try {
+            synchronized (crlLock) {
+                ret = X509_CRL_sign(this.crlPtr, evpKeyType, encodedKey,
+                    WolfSSL.SSL_FILETYPE_ASN1, digestAlg);
+            }
+        } finally {
+            Arrays.fill(encodedKey, (byte)0);
         }
 
         return ret;

src/java/com/wolfssl/WolfSSLCertRequest.java

@@ -23,6 +23,7 @@
 import java.io.File;
 import java.io.IOException;
 import java.nio.charset.Charset;
+import java.util.Arrays;
 import java.security.PublicKey;
 import java.security.PrivateKey;
 import java.security.interfaces.RSAPublicKey;
@@ -634,7 +635,11 @@ public void signRequest(String filePath, int keyType, int format,
                 "Failed to read bytes from file: " + filePath);
         }
 
-        signRequest(fileBytes, keyType, format, digestAlg);
+        try {
+            signRequest(fileBytes, keyType, format, digestAlg);
+        } finally {
+            Arrays.fill(fileBytes, (byte)0);
+        }
     }
 
     /**
@@ -751,9 +756,13 @@ else if (key instanceof ECPrivateKey) {
             throw new WolfSSLException("PrivateKey does not support encoding");
         }
 
-        synchronized (x509ReqLock) {
-            ret = X509_REQ_sign(this.x509ReqPtr, evpKeyType, encodedKey,
-                WolfSSL.SSL_FILETYPE_ASN1, digestAlg);
+        try {
+            synchronized (x509ReqLock) {
+                ret = X509_REQ_sign(this.x509ReqPtr, evpKeyType, encodedKey,
+                    WolfSSL.SSL_FILETYPE_ASN1, digestAlg);
+            }
+        } finally {
+            Arrays.fill(encodedKey, (byte)0);
         }
 
         if (ret != WolfSSL.SSL_SUCCESS) {

src/java/com/wolfssl/WolfSSLCertificate.java

@@ -1345,7 +1345,11 @@ public void signCert(String filePath, int keyType, int format,
                 "Failed to read bytes from file: " + filePath);
         }
 
-        signCert(fileBytes, keyType, format, digestAlg);
+        try {
+            signCert(fileBytes, keyType, format, digestAlg);
+        } finally {
+            Arrays.fill(fileBytes, (byte)0);
+        }
     }
 
     /**
@@ -1461,9 +1465,13 @@ else if (key instanceof ECPrivateKey) {
             throw new WolfSSLException("PrivateKey does not support encoding");
         }
 
-        synchronized (x509Lock) {
-            ret = X509_sign(this.x509Ptr, evpKeyType, encodedKey,
-                WolfSSL.SSL_FILETYPE_ASN1, digestAlg);
+        try {
+            synchronized (x509Lock) {
+                ret = X509_sign(this.x509Ptr, evpKeyType, encodedKey,
+                    WolfSSL.SSL_FILETYPE_ASN1, digestAlg);
+            }
+        } finally {
+            Arrays.fill(encodedKey, (byte)0);
         }
 
         if (ret != WolfSSL.SSL_SUCCESS) {