netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Proof of concept

Safe local verification was performed without native BoringSSL by compiling the relevant Java classes and a no-op native stub for the unused finalizer reference. The observed output includes the full private key byte array:

BoringSSLAsymmetricCipherKeyPair{privateKey=BoringSSLAsymmetricKeyParameter{bytes=[1, 2, 3, 4], isPrivate=true}, publicKey=BoringSSLAsymmetricKeyParameter{bytes=[5, 6, 7, 8], isPrivate=false}}

Minimal reproducer concept in the same package:

package io.netty.incubator.codec.hpke.boringssl;

public final class VerifyPrivateKeyToString {
  public static void main(String[] args) {
    byte[] privateKey = new byte[] {1, 2, 3, 4};
    byte[] publicKey = new byte[] {5, 6, 7, 8};
    BoringSSLAsymmetricCipherKeyPair pair = new BoringSSLAsymmetricCipherKeyPair(privateKey, publicKey);
    System.out.println(pair.toString());
  }
}

The code path is deterministic: the production toString() methods concatenate the raw private-key byte array.

Impact

If an affected key pair or initialization exception is logged, application logs contain complete HPKE private key material. Anyone with access to those logs can recover the key. Depending on key reuse and log retention, this can compromise:

• confidentiality of OHTTP messages encrypted to the exposed key;
• integrity/authenticity expectations for future messages if the key remains active;
• incident response and key rotation assumptions, because logs may retain key material long after the in-memory key is rotated.

Suggested remediation

• Redact private key material in BoringSSLAsymmetricKeyParameter.toString() when isPrivate is true, for example bytes=<redacted> or only key type/length.
• Redact privateKey in BoringSSLAsymmetricCipherKeyPair.toString().
• Remove Arrays.toString(privateKeyBytes) from BoringSSL.EVP_HPKE_KEY_init_or_throw(...); report only length and KEM metadata.
• Add regression tests asserting that toString() and exception messages do not contain private key byte values.
• Consider making key pair classes avoid implementing detailed toString() for sensitive material entirely.

References

• codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java:72-78
• codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java:70-76
• codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java:228-232