Question

According to the msdn docs for System.Security.Cryptography.SymmetricAlgorithm

Note that when using derived classes, it is not enough, from a security perspective, to simply force a garbage collection after you have finished using the object. You must explicitly call the Clear method on the object to zero out any sensitive data within the object before it is released. Note that garbage collection does not zero out the contents of collected objects but simply marks the memory as available for reallocation. Thus the data contained within a garbage collected object may still be present in the memory heap in unallocated memory. In the case of cryptographic objects, this data could contain sensitive information such as key data or a block of plain text.

All cryptographic classes in the .NET Framework that hold sensitive data implement a Clear method. When called, the Clear method overwrites all sensitive data within the object with zeros and then releases the object so that it can be safely garbage collected. When the object has been zeroed and released, you should then call the Dispose method with the disposing parameter set to True to dispose of all managed and unmanaged resources associated with the object.

What I’m getting from this is that I have to use a try-finally block to dispose of my algorithm, like so:

SymmetricAlgorithm symmetricAlgorithm = SymmetricAlgorithm.Create()
try 
{
     //stuff
}
finally
{
    symmetricAlgorithm.Clear();
    symmetricAlgorithm.Dispose(true)
}

I wouldn’t be able to use the more concise using block

using (var symmetricAlgorithm = SymmetricAlgorithm.Create())
{
    //do stuff
}

because it won’t clear the memory. It will only mark it for collection. Is that correct? Thanks for the help.

Answer 1

Here is how Clear method is implemented (from Reflector):

public void Clear()
{
    ((IDisposable) this).Dispose();
}

So you can use using block.