Package co.ankatech.ankasecure.sdk.security

Class Zeroization

java.lang.Object

co.ankatech.ankasecure.sdk.security.Zeroization

public final class Zeroization
extends Object

Centralized zeroization helpers for the ANKASecure secure-memory layer.

All buffers passed in are overwritten in place using Arrays.fill(byte[], byte) and Arrays.fill(char[], char), which is the only portable mechanism available on the JVM. JIT register spills, JVM string interning, and Bouncy Castle internal pools are NOT addressed by these methods (see SECURE_MEMORY.md for the complete capability matrix).

Method Summary

Modifier and Type	Method	Description
static void	destroyIfPossible(Object obj)	Calls Destroyable.destroy() if the supplied object implements Destroyable and is not yet destroyed.
static void	zeroize(byte[] buf)	Overwrites every element with 0x00.
static void	zeroize(char[] buf)	Overwrites every element with the space character ' '.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

zeroize

public static void zeroize(byte[] buf)

Overwrites every element with 0x00. Null-safe (no-op on null).

zeroize

public static void zeroize(char[] buf)

Overwrites every element with the space character ' '. Null-safe (no-op on null).

Space-fill (rather than '') is a deliberate choice: spaces are visible in heap dumps as printable text, making accidental retention easier to spot during forensic analysis. The security guarantee is identical — the original sensitive content is replaced.

destroyIfPossible

public static void destroyIfPossible(Object obj)

Calls Destroyable.destroy() if the supplied object implements Destroyable and is not yet destroyed. Swallows DestroyFailedException, which the JDK throws by default for SecretKeySpec and several Bouncy Castle types.

When this exception is swallowed, zeroization of the wrapping byte[] remains the caller's responsibility. SecretBuffer provides the standard pattern.

Null-safe: passing null is a no-op.