From c3c8572722d332f31c3e9b932dfab809bfd293a9 Mon Sep 17 00:00:00 2001
From: Paul Schaub <vanitasvitae@fsfe.org>
Date: Sat, 7 Jul 2018 14:34:33 +0200
Subject: [PATCH] Introduce passphrase class

---
 .../PassphraseMapKeyRingProtector.java        | 21 ++++-----
 .../pgpainless/util/Passphrase.java           | 44 +++++++++++++++++++
 2 files changed, 55 insertions(+), 10 deletions(-)
 create mode 100644 src/main/java/org/pgpainless/pgpainless/util/Passphrase.java

diff --git a/src/main/java/org/pgpainless/pgpainless/key/protection/PassphraseMapKeyRingProtector.java b/src/main/java/org/pgpainless/pgpainless/key/protection/PassphraseMapKeyRingProtector.java
index e2565d95..b2529aee 100644
--- a/src/main/java/org/pgpainless/pgpainless/key/protection/PassphraseMapKeyRingProtector.java
+++ b/src/main/java/org/pgpainless/pgpainless/key/protection/PassphraseMapKeyRingProtector.java
@@ -25,6 +25,7 @@ import org.bouncycastle.openpgp.operator.PGPDigestCalculatorProvider;
 import org.bouncycastle.openpgp.operator.bc.BcPBESecretKeyDecryptorBuilder;
 import org.bouncycastle.openpgp.operator.bc.BcPBESecretKeyEncryptorBuilder;
 import org.bouncycastle.openpgp.operator.bc.BcPGPDigestCalculatorProvider;
+import org.pgpainless.pgpainless.util.Passphrase;
 
 /**
  * Implementation of the {@link SecretKeyRingProtector} which holds a map of key ids and their passwords.
@@ -33,38 +34,38 @@ public class PassphraseMapKeyRingProtector implements SecretKeyRingProtector {
 
     private static final PGPDigestCalculatorProvider calculatorProvider = new BcPGPDigestCalculatorProvider();
 
-    private final Map<Long, char[]> passphrases = new HashMap<>();
+    private final Map<Long, Passphrase> passphrases = new HashMap<>();
     private final KeyRingProtectionSettings protectionSettings;
 
-    public PassphraseMapKeyRingProtector(Map<Long, char[]> passphrases, KeyRingProtectionSettings protectionSettings) {
+    public PassphraseMapKeyRingProtector(Map<Long, Passphrase> passphrases, KeyRingProtectionSettings protectionSettings) {
         this.passphrases.putAll(passphrases);
         this.protectionSettings = protectionSettings;
     }
 
-    public void addPassphrase(Long keyId, char[] passphrase) {
+    public void addPassphrase(Long keyId, Passphrase passphrase) {
         this.passphrases.put(keyId, passphrase);
     }
 
     public void forgetPassphrase(Long keyId) {
-        char[] passphrase = passphrases.get(keyId);
-        // Overwrite the passphrase in memory with zeros
-        for (int i = 0; i < passphrase.length; i++) {
-            passphrase[i] = '0';
-        }
+        Passphrase passphrase = passphrases.get(keyId);
+        passphrase.clear();
         passphrases.remove(keyId);
     }
 
     @Override
     public PBESecretKeyDecryptor getDecryptor(Long keyId) {
-        return new BcPBESecretKeyDecryptorBuilder(calculatorProvider).build(passphrases.get(keyId));
+        Passphrase passphrase = passphrases.get(keyId);
+        return new BcPBESecretKeyDecryptorBuilder(calculatorProvider)
+                .build(passphrase != null ? passphrase.getChars() : null);
     }
 
     @Override
     public PBESecretKeyEncryptor getEncryptor(Long keyId) throws PGPException {
+        Passphrase passphrase = passphrases.get(keyId);
         return new BcPBESecretKeyEncryptorBuilder(
                 protectionSettings.getEncryptionAlgorithm().getAlgorithmId(),
                 calculatorProvider.get(protectionSettings.getHashAlgorithm().getAlgorithmId()),
                 protectionSettings.getS2kCount())
-                .build(passphrases.get(keyId));
+                .build(passphrase != null ? passphrase.getChars() : null);
     }
 }
diff --git a/src/main/java/org/pgpainless/pgpainless/util/Passphrase.java b/src/main/java/org/pgpainless/pgpainless/util/Passphrase.java
new file mode 100644
index 00000000..9be26738
--- /dev/null
+++ b/src/main/java/org/pgpainless/pgpainless/util/Passphrase.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2018 Paul Schaub.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pgpainless.pgpainless.util;
+
+import java.util.Arrays;
+
+public class Passphrase {
+
+    private final char[] chars;
+
+    public Passphrase(char[] chars) {
+        if (chars == null) {
+            throw new NullPointerException("chars MUST NOT be null.");
+        }
+        this.chars = chars;
+    }
+
+    public void clear() {
+        Arrays.fill(chars, ' ');
+    }
+
+    @Override
+    protected void finalize() throws Throwable {
+        clear();
+        super.finalize();
+    }
+
+    public char[] getChars() {
+        return chars;
+    }
+}