// Securely wipe temporary key references - guaranteed by try-finally
                if (encKey != null) {
                    SecureKeyManager.secureWipe(encKey);
                }
                if (decKey != null) {
                    SecureKeyManager.secureWipe(decKey);
                }
            }
        } catch (Exception e) {
            log.error("Error validating key lengths", e);

            return result;

        } finally {
            // Securely wipe plaintext bytes - guaranteed by try-finally
            if (plaintextBytes != null) {
                SecureKeyManager.secureWipe(plaintextBytes);
            }
        }
    }

    public char[] decryptCredentials(byte[] ciphertext) throws GeneralSecurityException {
        checkNotDestroyed();

            log.info("Rotated key for session {} from version {} to {}", sessionId, currentVersion, newVersion);

            // Securely wipe the old key copy
            secureWipe(currentKey);
            secureWipe(newKey);

            return newVersion;

        } catch (Exception e) {
            log.error("Failed to rotate key for session: {}", sessionId, e);

        SecureKeyManager.secureWipe(data);

        // Verify data is wiped
        for (byte b : data) {
            assertEquals(0, b, "All bytes should be zero after wipe");
        }
    }

    @Test
    public void testSecureWipeNull() {
        // Should not throw
        SecureKeyManager.secureWipe(null);
    }

    @Test

        } finally {
            // Wipe client challenge - guaranteed by try-finally
            if (clientChallenge != null) {
                SecureKeyManager.secureWipe(clientChallenge);
                clientChallenge = null;
            }
            closed = true;
        }
    }

    /**
     * Check if this authenticator has been closed
     *