Try to remove sensitive parts from memory more aggressively

[kwin]

Call SecretKey.destroy() and PBEKeySpec.clearPassword() to overwrite memory locations with 0 instead of just waiting for GC. Unfortunately right now not well supported by Java (https://bugs.openjdk.org/browse/JDK-8389121).

[Copilot]

Pull request overview

This PR aims to more aggressively reduce the lifetime of sensitive key material in memory during AES-GCM encryption/decryption by explicitly clearing password-derived key data instead of relying solely on garbage collection.

Changes:

• Clears PBEKeySpec password material via clearPassword() after key derivation.
• Attempts to destroy derived SecretKey instances via a new destroyQuietly(...) helper.
• Destroys encryption/decryption keys after doFinal(...).

Comments suppressed due to low confidence (2)

src/main/java/org/codehaus/plexus/components/secdispatcher/internal/cipher/AESGCMNoPadding.java:91

• secretKey is only destroyed on the happy path. If decoding, key derivation, init(...), or doFinal(...) throws, the key won't be destroyed. Wrap the method body so destroyQuietly(secretKey) always runs in finally.

            SecretKey secretKey = getAESKeyFromPassword(password.toCharArray(), salt);
            Cipher cipher = Cipher.getInstance(CIPHER_ALG);
            cipher.init(Cipher.DECRYPT_MODE, secretKey, new GCMParameterSpec(TAG_LENGTH_BIT, iv));
            byte[] plainText = cipher.doFinal(cipherText);
            destroyQuietly(secretKey);
            return new String(plainText, StandardCharsets.UTF_8);

src/main/java/org/codehaus/plexus/components/secdispatcher/internal/cipher/AESGCMNoPadding.java:110

• spec.clearPassword() and destroyQuietly(originalKey) should run even if generateSecret(...) or getEncoded() throws. Using try/finally here ensures password/key material is cleared on both success and failure paths.

        PBEKeySpec spec = new PBEKeySpec(password, salt, PBE_ITERATIONS, PBE_KEY_SIZE);
        SecretKey originalKey = factory.generateSecret(spec);
        spec.clearPassword();
        SecretKey derivedKey = new SecretKeySpec(originalKey.getEncoded(), KEY_ALGORITHM);
        destroyQuietly(originalKey);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.