public byte[] getClonedBytes() {
        ByteSource byteSource = cipherService.decryptInternal(ciphertext, key);
        // this's a newly created byte array
        return byteSource.getBytes();
    }
A simple implementation that maintains cipher service, ciphertext and key for decrypting it later.
{@link #useBytes(ByteSourceUser)} guarantees the sensitive data in byte array will be erased at end of use.
crypto/cipher/src/main/java/org/apache/shiro/crypto/cipher/SimpleByteSourceBroker.java