redact secret key material from Debug output

ml-kem/src/decapsulation_key.rs

@@ -8,6 +8,7 @@ use array::{
     Array, ArraySize,
     sizes::{U32, U64},
 };
+use core::fmt;
 use kem::{
     Ciphertext, Decapsulate, Decapsulator, Generate, InvalidKey, Kem, KeyExport, KeyInit,
     KeySizeUser,
@@ -23,7 +24,7 @@ use zeroize::{Zeroize, ZeroizeOnDrop};
 
 /// A `DecapsulationKey` provides the ability to generate a new key pair, and decapsulate an
 /// encapsulated shared key.
-#[derive(Clone, Debug)]
+#[derive(Clone)]
 pub struct DecapsulationKey<P>
 where
     P: KemParams,
@@ -128,6 +129,18 @@ where
     }
 }
 
+// Only show the public encapsulation key so secrets don't end up in logs
+impl<P> fmt::Debug for DecapsulationKey<P>
+where
+    P: KemParams,
+{
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("DecapsulationKey")
+            .field("ek", &self.ek)
+            .finish_non_exhaustive()
+    }
+}
+
 // Handwritten to omit `d` in the comparisons, so keys initialized from seeds compare equally to
 // keys initialized from the expanded form
 impl<P> PartialEq for DecapsulationKey<P>

ml-kem/src/pke.rs

@@ -7,6 +7,7 @@ use crate::compress::Compress;
 use crate::crypto::{G, PRF};
 use crate::param::{EncodedDecryptionKey, EncodedEncryptionKey, PkeParams};
 use array::typenum::{U1, Unsigned};
+use core::fmt;
 use kem::{Ciphertext, InvalidKey};
 use module_lattice::{
     Encode,
@@ -18,14 +19,24 @@ use zeroize::Zeroize;
 
 /// A `DecryptionKey` provides the ability to generate a new key pair, and decrypt an
 /// encrypted value.
-#[derive(Clone, Default, Debug)]
+#[derive(Clone, Default)]
 pub(crate) struct DecryptionKey<P>
 where
     P: PkeParams,
 {
     s_hat: NttVector<P::K>,
 }
 
+// Don't print the secret vector `s_hat`
+impl<P> fmt::Debug for DecryptionKey<P>
+where
+    P: PkeParams,
+{
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("DecryptionKey").finish_non_exhaustive()
+    }
+}
+
 impl<P> CtEq for DecryptionKey<P>
 where
     P: PkeParams,

ml-kem/tests/debug.rs

@@ -0,0 +1,29 @@
+//! `Debug` output tests.
+
+use core::fmt::Debug;
+use ml_kem::{Kem, MlKem512, MlKem768, MlKem1024, Seed, kem::Decapsulator};
+
+fn debug_redaction_test<K>()
+where
+    K: Kem,
+    K::DecapsulationKey: Debug + From<Seed>,
+{
+    let dk = K::DecapsulationKey::from(Seed::from([0x42; 64]));
+    let expected = format!(
+        "DecapsulationKey {{ ek: {:?}, .. }}",
+        dk.encapsulation_key()
+    );
+
+    // Not `assert_eq!`, which would print the secret key if this fails
+    assert!(
+        format!("{dk:?}") == expected,
+        "`Debug` output should only contain the encapsulation key"
+    );
+}
+
+#[test]
+fn debug_redaction() {
+    debug_redaction_test::<MlKem512>();
+    debug_redaction_test::<MlKem768>();
+    debug_redaction_test::<MlKem1024>();
+}