I’ve just stumbled across some crypto interface code written in Java where buffers of (sensitive) data/keys are not explicitly erased (zeroed out) after use. Coming from a C programming background where explicit zeroing outof memory after use is highly recommended, I’m wondering whether this should also be done in Java. I understand that it’s impossible to guaranteeefficient erasure of all possible instances of a data object in Java.
I’m seeing two contradictory arguments here:
• Explicit zeroing out of a memory object after use may considerably reduce, ideally eliminate the likelihood/number of remaining object instances with the original content.
• Explicit zeroing out (i.e. alteration) of a memory object may cause thememory manager to explicitly create a new (additional) copy of the original content. Hence, this action would not catch the initial instance of the data abject, but only create additional overhead.
Does it make sense to distinguish between "simple" data types (e.g. an int array with constant size) and "complex" data types (e.g. a string object)? Do you know of any good research or reference about this? I haven’t foundanything well investigated in the Internet. Both arguments exist.
secure erasure of Java key/password buffers 
Linear Mode
