Zero DH shared secret and key material after use in HPKE KEM

src/main/java/com/google/crypto/tink/hybrid/internal/NistCurvesHpkeKem.java

@@ -25,6 +25,7 @@
 import java.security.KeyPair;
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
+import java.util.Arrays;
 
 /** Diffie-Hellman-based P-256, P-384 and P-521 HPKE KEM variant. */
 @Immutable
@@ -150,8 +151,12 @@ public byte[] decapsulate(byte[] encapsulatedKey, HpkeKemPrivateKey recipientPri
     ECPublicKey publicKey =
         EllipticCurves.getEcPublicKey(curve, PointFormatType.UNCOMPRESSED, encapsulatedKey);
     byte[] dhSharedSecret = EllipticCurves.computeSharedSecret(privateKey, publicKey);
-    return deriveKemSharedSecret(
-        dhSharedSecret, encapsulatedKey, recipientPrivateKey.getSerializedPublic().toByteArray());
+    try {
+      return deriveKemSharedSecret(
+          dhSharedSecret, encapsulatedKey, recipientPrivateKey.getSerializedPublic().toByteArray());
+    } finally {
+      Arrays.fill(dhSharedSecret, (byte) 0);
+    }
   }
 
   @Override
@@ -171,11 +176,15 @@ public byte[] authDecapsulate(
                 privateKey,
                 EllipticCurves.getEcPublicKey(
                     curve, PointFormatType.UNCOMPRESSED, senderPublicKey)));
-    return deriveKemSharedSecret(
-        dhSharedSecret,
-        encapsulatedKey,
-        recipientPrivateKey.getSerializedPublic().toByteArray(),
-        senderPublicKey);
+    try {
+      return deriveKemSharedSecret(
+          dhSharedSecret,
+          encapsulatedKey,
+          recipientPrivateKey.getSerializedPublic().toByteArray(),
+          senderPublicKey);
+    } finally {
+      Arrays.fill(dhSharedSecret, (byte) 0);
+    }
   }
 
   @Override

src/main/java/com/google/crypto/tink/hybrid/internal/X25519HpkeKem.java

@@ -145,8 +145,12 @@ public byte[] decapsulate(byte[] encapsulatedKey, HpkeKemPrivateKey recipientPri
     byte[] dhSharedSecret =
         x25519.computeSharedSecret(
             recipientPrivateKey.getSerializedPrivate().toByteArray(), encapsulatedKey);
-    return deriveKemSharedSecret(
-        dhSharedSecret, encapsulatedKey, recipientPrivateKey.getSerializedPublic().toByteArray());
+    try {
+      return deriveKemSharedSecret(
+          dhSharedSecret, encapsulatedKey, recipientPrivateKey.getSerializedPublic().toByteArray());
+    } finally {
+      Arrays.fill(dhSharedSecret, (byte) 0);
+    }
   }
 
   @Override
@@ -159,8 +163,13 @@ public byte[] authDecapsulate(
             x25519.computeSharedSecret(privateKey, encapsulatedKey),
             x25519.computeSharedSecret(privateKey, senderPublicKey));
     byte[] recipientPublicKey = recipientPrivateKey.getSerializedPublic().toByteArray();
-    return deriveKemSharedSecret(
-        dhSharedSecret, encapsulatedKey, recipientPublicKey, senderPublicKey);
+    try {
+      return deriveKemSharedSecret(
+          dhSharedSecret, encapsulatedKey, recipientPublicKey, senderPublicKey);
+    } finally {
+      Arrays.fill(privateKey, (byte) 0);
+      Arrays.fill(dhSharedSecret, (byte) 0);
+    }
   }
 
   @Override

src/main/java/com/google/crypto/tink/util/SecretBigInteger.java

@@ -20,6 +20,7 @@
 import com.google.errorprone.annotations.Immutable;
 import java.math.BigInteger;
 import java.security.MessageDigest;
+import java.util.Arrays;
 
 /** A class storing a secret BigInteger, protecting the value via {@link SecretKeyAccess}. */
 @Immutable
@@ -65,6 +66,11 @@ public boolean equalsSecretBigInteger(SecretBigInteger other) {
     // BigInteger of the same values return different encodings.
     byte[] myArray = value.toByteArray();
     byte[] otherArray = other.value.toByteArray();
-    return MessageDigest.isEqual(myArray, otherArray);
+    try {
+      return MessageDigest.isEqual(myArray, otherArray);
+    } finally {
+      Arrays.fill(myArray, (byte) 0);
+      Arrays.fill(otherArray, (byte) 0);
+    }
   }
 }