5.3.3 Residual Information Protection (FDP_RIP) 
5.3.3.1 Full Residual Information Protection (FDP_RIP.2) 

FDP_RIP.2.1
    Refinement: The TSF shall ensure that any previous information 
    content of a resource is made unavailable upon the [selection: allocation 
    of the resource to, deallocation of the resource from] all objects other 
    than those associated with cryptographic keys and critical cryptographic
    security parameters as described in FCS_CKM.4.1 and FCS_CKM_EXP.2.5. 

Application Note: This requirement applies to all resources except for
    cryptographic keys and critical cryptographic security parameters governed
    by or used by the TSF; it includes resources used to store data and
    attributes.  It also includes the encrypted representation of information.
    Residual information protection for cryptographic data is covered in class
    FCS. 

Application Note: Clearing the content of resources on deallocation is
    sufficient to satisfy this requirement, provided that unallocated
    resources will not accumulate new information until they are allocated
    again. 

FCS_CKM.4.1:
    Refinement: The TSF shall destroy cryptographic keys in 
    accordance with a cryptographic key destruction method that meets 
    the following: 
    a) FIPS PUB 140-2, "Security Requirements for Cryptographic Modules"

    b) Zeroization of all plaintext cryptographic keys and all other critical 
       cryptographic security parameters shall be immediate and complete. 

Application Note: The term "immediate" here is meant to impart some urgency
    to the destruction: it should happen as soon as practical after the key
    is no longer required to be in plaintext. It is certainly permissible to
    complete a critical section of code before destroying the key.  However,
    the destruction shouldn't wait for idle time, and there shouldn't be any
    non-determined event (such as waiting for user input) which occurs before
    it is destroyed. 

    c) For non-volatile memories other than EEPROM and Flash, the zeroization
       shall be executed by overwriting the key/critical cryptographic
       security parameter storage area three or more times using a different
       alternating data pattern each time. 

Application Note: Although verification of this zeroization of a plaintext
    key/critical cryptographic security parameter is desired here (by checking
    for the final known alternating data pattern), it is not required at this
    time. However, vendors are highly encouraged to incorporate this
    verification whenever possible into their implementations. 

    d) For volatile memory and non-volatile EEPROM and Flash memories, the
       zeroization shall be executed by overwriting the key/critical
       cryptographic security parameter storage area with a single direct
       overwrite consisting of a pseudo random pattern, followed by a read-
       verify. 

Application Note: Zeroization of any storage, such as memory buffers, that
    is included in the path of a plaintext key/critical cryptographic
    security parameter is addressed in FCS_CKM_EXP.2 (Cryptographic Key
    Handling and Storage). 

FCS_CKM_EXP_2.5
    The TSF shall destroy non-persistent cryptographic keys after a
    cryptographic administrator-defined period of time of inactivity. 

Application Note: The cryptographic administrator must have the ability to
    set a threshold of inactivity after which non-persistent keys must be
    destroyed in accordance with FCS_CKM.4.