Search code examples
javakeytool

Does keytool use some data erasure procedure to delete an entry internally?

Do they use some secure data erasure procedure like Bruce Schneier's algorithm, Peter Gutmann's Algorithm or other pattern?

Solution

  • Firstly, that's not where any erasure code would be. It would actually be in (or around) the com.sun.crypto.provider.JceKeyStore class. That is the built-in implementation of the KeyStoreSpi used by keytool, etcetera.

    But looking at those, I think that the answer is No.

    In fact, the engineDeleteEntry method is just manipulating an in-memory copy of the keystore. There are separate methods for loading and storing the in-memory keystore. These just operate on InputStream and OutputStream ... and don't do anything special to erase the previous copy of the file.

    That leaves us with keytool itself as a place where erasure could possibly happen happen. And it doesn't. It simply opens a FileOutputStream and writes the new (encrypted) keystore contents to the output file.

    But as others have noted, there is little value in erasing the old copy of the file ... given that a keystore stored in an encrypted form.