1

Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device.

In the native applications for Windows, OSX, and Linux, whenever the database is locked or exited, the password is erased from memory by filling its location with zeroes.

Since Java itself does garbage collection in a different manner, is there a real, tangible concern over storing passphrases in memory in the JVM? How about in Dalvik for Android?

Other than setting this.password = null;, what can be done to ensure that the passphrase has been securely erased from memory?

1

In Java the memory management is completely under the control of the VM. You can never be 100% sure what the VM does with its memory, because that's completely up to the implementation. However, there are things you can do to discourage the VM from caching.

Just null-ing a reference is not a good way to persuade the VM to remove something from memory. It will take at least until the next garbage collector sweep until the data is collected. With the class String you also have the problem that the Java specification mandates string pooling (multiple strings with identical content are mandated to use the same memory). This could be a reason for the VM to cache a string in memory even when there are no references to it.

What you could do instead is go the low-level C way and store your password in a char[]. There isn't much reason for the JVM to do much abstraction on arrays of primitives. When you overwrite each entry of a char-array with nul-characters, it is quite unlikely that the JVM will keep a copy of the original content.

  • Do you mean a Java char array or a C/JNI char array? – Naftuli Kay May 30 '14 at 1:15
  • @NaftuliTzviKay Java char-array. But implementing the password storage in C and accessing it with JNI would give you even more control over the memory management. – Philipp May 30 '14 at 1:23
  • Yeah. What's actually pretty scary is that KeePassDroid not only has to keep the safe's password in memory, but all passwords in memory, AFAIK. Wondering if this went into thought before the creation of the program... – Naftuli Kay May 30 '14 at 4:26
  • Java specs require String constants and String.intern() results to share storage, other cases are implementation option. The Sun (desktop) JRE in particular changed sharing of .substring() values at 7u06 in 2012; see stackoverflow 3451145 and 1881922. I don't know if/how that maps to Dalvik. – dave_thompson_085 May 30 '14 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.