Merge pull request #17 from 10d9e/security/hazmat-feature-names

Rename test-harness features to hazmat-* to flag secret exposure

Author: nadimkobeissi

.github/workflows/ci.yml

@@ -29,14 +29,14 @@ jobs:
         run: cargo fmt --check
       - name: cargo clippy (default)
         run: cargo clippy --all-targets -- -D warnings
-      - name: cargo clippy (pq + kat-internals)
-        run: cargo clippy --all-targets --features pq,kat-internals -- -D warnings
+      - name: cargo clippy (pq + hazmat-kat-internals)
+        run: cargo clippy --all-targets --features pq,hazmat-kat-internals -- -D warnings
       - name: cargo test
         run: cargo test
-      - name: cargo test (pq + kat-internals)
-        run: cargo test --features pq,kat-internals
-      - name: cargo test (pq + differential + kat-internals)
-        run: cargo test --features pq,differential,kat-internals
+      - name: cargo test (pq + hazmat-kat-internals)
+        run: cargo test --features pq,hazmat-kat-internals
+      - name: cargo test (pq + hazmat-differential + hazmat-kat-internals)
+        run: cargo test --features pq,hazmat-differential,hazmat-kat-internals
       - name: cargo build --release
         run: cargo build --release
 

Cargo.toml

@@ -36,9 +36,14 @@ default       = ["std"]
 std           = ["subtle/std", "aes-gcm/std", "chacha20poly1305/std"]
 pq            = ["dep:ml-kem", "dep:x-wing", "dep:shake"]
 serde         = ["dep:serde"]
-differential  = []
-comparative   = ["pq"]
-kat-internals = []
+# The two `hazmat-*` features expose secret internals (raw AEAD keys,
+# exporter secrets, deterministic ephemeral-key injection) for the KAT and
+# differential test harnesses. Never enable them in production builds:
+# Cargo feature unification means any crate in the dependency graph that
+# turns them on enables them for every user of hpke-ng in that build.
+hazmat-differential  = []
+comparative          = ["pq"]
+hazmat-kat-internals = []
 
 [dev-dependencies]
 hpke-rs             = { version = "0.6", features = ["std", "rustcrypto", "hpke-test", "hpke-test-prng", "hazmat"] }
@@ -59,7 +64,7 @@ codegen-units = 1
 
 [[test]]
 name = "kat"
-required-features = ["kat-internals"]
+required-features = ["hazmat-kat-internals"]
 
 [[test]]
 name = "compile_fail"

README.md

@@ -159,14 +159,14 @@ This crate composes RustCrypto primitives. Constant-time properties are inherite
 ```bash
 cargo test                                                 # library + roundtrip
 cargo test --features pq                                   # + post-quantum tests
-cargo test --features pq,kat-internals                     # + RFC 9180 KAT
-cargo test --features pq,kat-internals --test compile_fail # + compile-time invariant tests
-cargo test --features pq,differential,kat-internals        # + cross-impl differential vs hpke-rs
+cargo test --features pq,hazmat-kat-internals                     # + RFC 9180 KAT
+cargo test --features pq,hazmat-kat-internals --test compile_fail # + compile-time invariant tests
+cargo test --features pq,hazmat-differential,hazmat-kat-internals        # + cross-impl differential vs hpke-rs
 ```
 
 To regenerate the compile-fail `.stderr` fixtures after an intentional change (e.g. a toolchain bump), run:
 ```bash
-TRYBUILD=overwrite cargo test --features pq,kat-internals --test compile_fail
+TRYBUILD=overwrite cargo test --features pq,hazmat-kat-internals --test compile_fail
 ```
 This rewrites the fixtures unconditionally and should not be used as the normal test invocation.
 

fuzz/Cargo.toml

@@ -16,7 +16,7 @@ libfuzzer-sys = "0.4"
 
 [dependencies.hpke-ng]
 path     = ".."
-features = ["pq", "kat-internals"]
+features = ["pq", "hazmat-kat-internals"]
 
 # Keep optimisations on for libFuzzer; debug assertions remain enabled by
 # default (cargo-fuzz overrides `[profile.release].debug-assertions = true`).

src/context.rs

@@ -26,7 +26,7 @@ pub struct Context<K: Kem, F: Kdf, A: Aead> {
 	/// Raw AEAD key bytes — kept under cfg gate so the test/KAT/differential
 	/// harnesses can assert on them. Production builds carry only the
 	/// derived `cipher` state.
-	#[cfg(any(test, feature = "kat-internals", feature = "differential"))]
+	#[cfg(any(test, feature = "hazmat-kat-internals", feature = "hazmat-differential"))]
 	raw_key: Zeroizing<Vec<u8>>,
 	_kfa: PhantomData<(K, F, A)>,
 }
@@ -72,7 +72,7 @@ impl<K: Kem, F: Kdf, A: Aead> Context<K, F, A> {
 			base_nonce: nonce_arr,
 			exporter_secret: Zeroizing::new(exporter_secret),
 			seq: 0,
-			#[cfg(any(test, feature = "kat-internals", feature = "differential"))]
+			#[cfg(any(test, feature = "hazmat-kat-internals", feature = "hazmat-differential"))]
 			raw_key: Zeroizing::new(key_z.to_vec()),
 			_kfa: PhantomData,
 		})
@@ -113,7 +113,7 @@ impl<K: Kem, F: Kdf, A: Aead> Context<K, F, A> {
 	}
 }
 
-#[cfg(any(test, feature = "kat-internals", feature = "differential"))]
+#[cfg(any(test, feature = "hazmat-kat-internals", feature = "hazmat-differential"))]
 impl<K: Kem, F: Kdf, A: Aead> Context<K, F, A> {
 	/// Test-only: expose the AEAD key.
 	#[must_use]
@@ -213,7 +213,7 @@ impl<K: Kem, F: Kdf, A: Aead> SenderContext<K, F, A> {
 	/// Test/KAT/differential-only: wrap a raw key-schedule [`Context`] as a
 	/// sender context (the harnesses build contexts from injected shared
 	/// secrets rather than through `setup_sender_*`).
-	#[cfg(any(test, feature = "kat-internals", feature = "differential"))]
+	#[cfg(any(test, feature = "hazmat-kat-internals", feature = "hazmat-differential"))]
 	#[doc(hidden)]
 	#[must_use]
 	pub fn from_context(inner: Context<K, F, A>) -> Self {
@@ -252,7 +252,7 @@ impl<K: Kem, F: Kdf, A: SealingAead> ReceiverContext<K, F, A> {
 }
 
 /// Test/KAT/differential accessors that delegate to the inner [`Context`].
-#[cfg(any(test, feature = "kat-internals", feature = "differential"))]
+#[cfg(any(test, feature = "hazmat-kat-internals", feature = "hazmat-differential"))]
 impl<K: Kem, F: Kdf, A: Aead> ReceiverContext<K, F, A> {
 	/// Test-only: expose the AEAD key.
 	#[must_use]

src/kem/dh.rs

@@ -490,7 +490,7 @@ fn encap_with<D: DiffieHellman, H: Kdf, R: CryptoRng>(
 
 /// Test-only API: encap with a caller-supplied IKM for the ephemeral key, used
 /// by KAT and differential test harnesses.
-#[cfg(any(test, feature = "kat-internals", feature = "differential"))]
+#[cfg(any(test, feature = "hazmat-kat-internals", feature = "hazmat-differential"))]
 #[allow(dead_code)]
 pub(crate) fn encap_with_ikm<D: DiffieHellman, H: Kdf>(
 	pk_r: &DhPublicKey<D>,
@@ -506,7 +506,7 @@ pub(crate) fn encap_with_ikm<D: DiffieHellman, H: Kdf>(
 	))
 }
 
-#[cfg(any(test, feature = "kat-internals", feature = "differential"))]
+#[cfg(any(test, feature = "hazmat-kat-internals", feature = "hazmat-differential"))]
 #[allow(dead_code)]
 pub(crate) fn auth_encap_with_ikm<D: DiffieHellman, H: Kdf>(
 	pk_r: &DhPublicKey<D>,
@@ -527,7 +527,7 @@ pub(crate) fn auth_encap_with_ikm<D: DiffieHellman, H: Kdf>(
 	))
 }
 
-#[cfg(any(test, feature = "kat-internals", feature = "differential"))]
+#[cfg(any(test, feature = "hazmat-kat-internals", feature = "hazmat-differential"))]
 impl<D: DiffieHellman, H: Kdf> DhKem<D, H> {
 	/// Test-only: encap with a caller-supplied ephemeral IKM (deterministic).
 	pub fn encap_with_ikm(

src/lib.rs

@@ -227,15 +227,15 @@ fn key_schedule_psk_free_impl<M: PskFreeMode, K: Kem, F: Kdf, A: Aead>(
 }
 
 // Public-facing wrapper — visibility changes with feature gate.
-#[cfg(not(feature = "kat-internals"))]
+#[cfg(not(feature = "hazmat-kat-internals"))]
 pub(crate) fn key_schedule_psk_free<M: PskFreeMode, K: Kem, F: Kdf, A: Aead>(
 	shared_secret: &[u8],
 	info: &[u8],
 ) -> Result<Context<K, F, A>, HpkeError> {
 	key_schedule_psk_free_impl::<M, K, F, A>(shared_secret, info)
 }
 
-#[cfg(feature = "kat-internals")]
+#[cfg(feature = "hazmat-kat-internals")]
 #[doc(hidden)]
 pub fn key_schedule_psk_free<M: PskFreeMode, K: Kem, F: Kdf, A: Aead>(
 	shared_secret: &[u8],
@@ -280,7 +280,7 @@ fn key_schedule_psk_impl<M: PskMode, K: Kem, F: Kdf, A: Aead>(
 }
 
 // Public-facing wrapper — visibility changes with feature gate.
-#[cfg(not(feature = "kat-internals"))]
+#[cfg(not(feature = "hazmat-kat-internals"))]
 pub(crate) fn key_schedule_psk<M: PskMode, K: Kem, F: Kdf, A: Aead>(
 	shared_secret: &[u8],
 	info: &[u8],
@@ -290,7 +290,7 @@ pub(crate) fn key_schedule_psk<M: PskMode, K: Kem, F: Kdf, A: Aead>(
 	key_schedule_psk_impl::<M, K, F, A>(shared_secret, info, psk, psk_id)
 }
 
-#[cfg(feature = "kat-internals")]
+#[cfg(feature = "hazmat-kat-internals")]
 #[doc(hidden)]
 pub fn key_schedule_psk<M: PskMode, K: Kem, F: Kdf, A: Aead>(
 	shared_secret: &[u8],
@@ -679,7 +679,7 @@ impl<K: AuthKem, F: Kdf, A: Aead> Hpke<K, F, A> {
 	}
 }
 
-#[cfg(feature = "kat-internals")]
+#[cfg(feature = "hazmat-kat-internals")]
 #[doc(hidden)]
 pub mod __test_only {
 	pub use crate::key_schedule_psk;

tests/compile_fail.rs

@@ -1,7 +1,7 @@
 //! To regenerate the compile-fail `.stderr` fixtures after
 //! an intentional change (e.g. a toolchain bump), run:
 //!
-//! `TRYBUILD=overwrite cargo test --features pq,kat-internals --test compile_fail`
+//! `TRYBUILD=overwrite cargo test --features pq,hazmat-kat-internals --test compile_fail`
 //!
 #[test]
 fn compile_fail() {

tests/differential.rs

@@ -1,7 +1,7 @@
 //! Cross-implementation differential test: feed identical inputs to `hpke-ng`
 //! and `hpke-rs` and assert byte-equal outputs.
 //!
-//! Run with: `cargo test --features differential,kat-internals --test differential`.
+//! Run with: `cargo test --features hazmat-differential,hazmat-kat-internals --test differential`.
 //!
 //! Strategy:
 //!   - Use `hpke-ng` as the *sender* with `encap_with_ikm` (deterministic ephemeral key).
@@ -15,7 +15,7 @@
 //! P-384 and P-521 are omitted because hpke-rs-rust-crypto 0.6 only supports
 //! X25519, P-256, and secp256k1 (the `supports_kem` gate rejects others).
 
-#![cfg(feature = "differential")]
+#![cfg(feature = "hazmat-differential")]
 #![allow(non_snake_case)]
 
 use hpke_ng as ng;