Redacted + improved privacy of private keys

packages/typescript/src/cryptography/keypair.ts

@@ -13,6 +13,7 @@
 import { toSerializedSignature } from './signature.js';
 import type { Transaction } from '../transactions/Transaction.js';
 import type { ClientWithCoreApi, Experimental_SuiClientTypes } from '../experimental/index.js';
+import { Redacted } from '../utils/redacted.js';
 
 export const PRIVATE_KEY_SIZE = 32;
 export const LEGACY_PRIVATE_KEY_SIZE = 64;
@@ -112,8 +113,15 @@
 export abstract class Keypair extends Signer {
 	/**
 	 * This returns the Bech32 secret key string for this keypair.
+	 *
+	 * We recommend using `getSecretKeyRedacted()` instead, to ensure the secret key is not logged.
 	 */
 	abstract getSecretKey(): string;
+
+	/**
+	 * Get the secret key for this keypair, with the value redacted so that it cannot be logged.
+	 */
+	abstract getSecretKeyRedacted(): Redacted<string>;
 }
 
 /**

packages/typescript/src/keypairs/ed25519/keypair.ts

@@ -13,6 +13,8 @@ import { isValidHardenedPath, mnemonicToSeedHex } from '../../cryptography/mnemo
 import type { SignatureScheme } from '../../cryptography/signature-scheme.js';
 import { derivePath } from './ed25519-hd-key.js';
 import { Ed25519PublicKey } from './publickey.js';
+import type { Redacted } from '../../utils/redacted.js';
+import { redacted, getRedactedOrPlainValue } from '../../utils/redacted.js';
 
 export const DEFAULT_ED25519_DERIVATION_PATH = "m/44'/784'/0'/0'/0'";
 
@@ -23,14 +25,17 @@ export const DEFAULT_ED25519_DERIVATION_PATH = "m/44'/784'/0'/0'/0'";
  */
 export interface Ed25519KeypairData {
 	publicKey: Uint8Array;
-	secretKey: Uint8Array;
+	secretKey: Uint8Array | Redacted<Uint8Array>;
 }
 
 /**
  * An Ed25519 Keypair used for signing transactions.
  */
 export class Ed25519Keypair extends Keypair {
-	private keypair: Ed25519KeypairData;
+	#keypair: {
+		publicKey: Uint8Array;
+		secretKey: Uint8Array;
+	};
 
 	/**
 	 * Create a new Ed25519 keypair instance.
@@ -41,13 +46,13 @@ export class Ed25519Keypair extends Keypair {
 	constructor(keypair?: Ed25519KeypairData) {
 		super();
 		if (keypair) {
-			this.keypair = {
+			this.#keypair = {
 				publicKey: keypair.publicKey,
-				secretKey: keypair.secretKey.slice(0, 32),
+				secretKey: getRedactedOrPlainValue(keypair.secretKey).slice(0, 32),
 			};
 		} else {
 			const privateKey = ed25519.utils.randomPrivateKey();
-			this.keypair = {
+			this.#keypair = {
 				publicKey: ed25519.getPublicKey(privateKey),
 				secretKey: privateKey,
 			};
@@ -122,24 +127,31 @@ export class Ed25519Keypair extends Keypair {
 	 * The public key for this Ed25519 keypair
 	 */
 	getPublicKey(): Ed25519PublicKey {
-		return new Ed25519PublicKey(this.keypair.publicKey);
+		return new Ed25519PublicKey(this.#keypair.publicKey);
 	}
 
 	/**
 	 * The Bech32 secret key string for this Ed25519 keypair
 	 */
 	getSecretKey(): string {
 		return encodeSuiPrivateKey(
-			this.keypair.secretKey.slice(0, PRIVATE_KEY_SIZE),
+			this.#keypair.secretKey.slice(0, PRIVATE_KEY_SIZE),
 			this.getKeyScheme(),
 		);
 	}
 
+	/**
+	 * The Bech32 secret key string for this Ed25519 keypair, with the value redacted so that it cannot be logged.
+	 */
+	getSecretKeyRedacted(): Redacted<string> {
+		return redacted(this.getSecretKey());
+	}
+
 	/**
 	 * Return the signature for the provided data using Ed25519.
 	 */
 	async sign(data: Uint8Array) {
-		return ed25519.sign(data, this.keypair.secretKey);
+		return ed25519.sign(data, this.#keypair.secretKey);
 	}
 
 	/**

packages/typescript/src/keypairs/secp256k1/keypair.ts

@@ -12,6 +12,8 @@ import { isValidBIP32Path, mnemonicToSeed } from '../../cryptography/mnemonics.j
 import type { PublicKey } from '../../cryptography/publickey.js';
 import type { SignatureScheme } from '../../cryptography/signature-scheme.js';
 import { Secp256k1PublicKey } from './publickey.js';
+import type { Redacted } from '../../utils/redacted.js';
+import { getRedactedOrPlainValue, redacted } from '../../utils/redacted.js';
 
 export const DEFAULT_SECP256K1_DERIVATION_PATH = "m/54'/784'/0'/0/0";
 
@@ -20,14 +22,17 @@ export const DEFAULT_SECP256K1_DERIVATION_PATH = "m/54'/784'/0'/0/0";
  */
 export interface Secp256k1KeypairData {
 	publicKey: Uint8Array;
-	secretKey: Uint8Array;
+	secretKey: Uint8Array | Redacted<Uint8Array>;
 }
 
 /**
  * An Secp256k1 Keypair used for signing transactions.
  */
 export class Secp256k1Keypair extends Keypair {
-	private keypair: Secp256k1KeypairData;
+	#keypair: {
+		publicKey: Uint8Array;
+		secretKey: Uint8Array;
+	};
 
 	/**
 	 * Create a new keypair instance.
@@ -38,12 +43,15 @@ export class Secp256k1Keypair extends Keypair {
 	constructor(keypair?: Secp256k1KeypairData) {
 		super();
 		if (keypair) {
-			this.keypair = keypair;
+			this.#keypair = {
+				publicKey: keypair.publicKey,
+				secretKey: getRedactedOrPlainValue(keypair.secretKey),
+			};
 		} else {
 			const secretKey: Uint8Array = secp256k1.utils.randomPrivateKey();
 			const publicKey: Uint8Array = secp256k1.getPublicKey(secretKey, true);
 
-			this.keypair = { publicKey, secretKey };
+			this.#keypair = { publicKey, secretKey };
 		}
 	}
 
@@ -115,21 +123,28 @@ export class Secp256k1Keypair extends Keypair {
 	 * The public key for this keypair
 	 */
 	getPublicKey(): PublicKey {
-		return new Secp256k1PublicKey(this.keypair.publicKey);
+		return new Secp256k1PublicKey(this.#keypair.publicKey);
 	}
 	/**
 	 * The Bech32 secret key string for this Secp256k1 keypair
 	 */
 	getSecretKey(): string {
-		return encodeSuiPrivateKey(this.keypair.secretKey, this.getKeyScheme());
+		return encodeSuiPrivateKey(this.#keypair.secretKey, this.getKeyScheme());
+	}
+
+	/**
+	 * The Bech32 secret key string for this Secp256k1 keypair, with the value redacted so that it cannot be logged.
+	 */
+	getSecretKeyRedacted(): Redacted<string> {
+		return redacted(this.getSecretKey());
 	}
 
 	/**
 	 * Return the signature for the provided data.
 	 */
 	async sign(data: Uint8Array) {
 		const msgHash = sha256(data);
-		const sig = secp256k1.sign(msgHash, this.keypair.secretKey, {
+		const sig = secp256k1.sign(msgHash, this.#keypair.secretKey, {
 			lowS: true,
 		});
 		return sig.toCompactRawBytes();

packages/typescript/src/keypairs/secp256r1/keypair.ts

@@ -12,6 +12,8 @@ import { isValidBIP32Path, mnemonicToSeed } from '../../cryptography/mnemonics.j
 import type { PublicKey } from '../../cryptography/publickey.js';
 import type { SignatureScheme } from '../../cryptography/signature-scheme.js';
 import { Secp256r1PublicKey } from './publickey.js';
+import type { Redacted } from '../../utils/redacted.js';
+import { getRedactedOrPlainValue, redacted } from '../../utils/redacted.js';
 
 export const DEFAULT_SECP256R1_DERIVATION_PATH = "m/74'/784'/0'/0/0";
 
@@ -20,14 +22,17 @@ export const DEFAULT_SECP256R1_DERIVATION_PATH = "m/74'/784'/0'/0/0";
  */
 export interface Secp256r1KeypairData {
 	publicKey: Uint8Array;
-	secretKey: Uint8Array;
+	secretKey: Uint8Array | Redacted<Uint8Array>;
 }
 
 /**
  * An Secp256r1 Keypair used for signing transactions.
  */
 export class Secp256r1Keypair extends Keypair {
-	private keypair: Secp256r1KeypairData;
+	#keypair: {
+		publicKey: Uint8Array;
+		secretKey: Uint8Array;
+	};
 
 	/**
 	 * Create a new keypair instance.
@@ -38,12 +43,15 @@ export class Secp256r1Keypair extends Keypair {
 	constructor(keypair?: Secp256r1KeypairData) {
 		super();
 		if (keypair) {
-			this.keypair = keypair;
+			this.#keypair = {
+				publicKey: keypair.publicKey,
+				secretKey: getRedactedOrPlainValue(keypair.secretKey),
+			};
 		} else {
 			const secretKey: Uint8Array = secp256r1.utils.randomPrivateKey();
 			const publicKey: Uint8Array = secp256r1.getPublicKey(secretKey, true);
 
-			this.keypair = { publicKey, secretKey };
+			this.#keypair = { publicKey, secretKey };
 		}
 	}
 
@@ -115,22 +123,29 @@ export class Secp256r1Keypair extends Keypair {
 	 * The public key for this keypair
 	 */
 	getPublicKey(): PublicKey {
-		return new Secp256r1PublicKey(this.keypair.publicKey);
+		return new Secp256r1PublicKey(this.#keypair.publicKey);
 	}
 
 	/**
 	 * The Bech32 secret key string for this Secp256r1 keypair
 	 */
 	getSecretKey(): string {
-		return encodeSuiPrivateKey(this.keypair.secretKey, this.getKeyScheme());
+		return encodeSuiPrivateKey(this.#keypair.secretKey, this.getKeyScheme());
+	}
+
+	/**
+	 * The Bech32 secret key string for this Secp256r1 keypair, with the value redacted so that it cannot be logged.
+	 */
+	getSecretKeyRedacted(): Redacted<string> {
+		return redacted(this.getSecretKey());
 	}
 
 	/**
 	 * Return the signature for the provided data.
 	 */
 	async sign(data: Uint8Array) {
 		const msgHash = sha256(data);
-		const sig = secp256r1.sign(msgHash, this.keypair.secretKey, {
+		const sig = secp256r1.sign(msgHash, this.#keypair.secretKey, {
 			lowS: true,
 		});
 		return sig.toCompactRawBytes();

packages/typescript/src/utils/index.ts

@@ -42,3 +42,5 @@ export {
 export { isValidNamedPackage, isValidNamedType } from './move-registry.js';
 
 export { deriveDynamicFieldID } from './dynamic-fields.js';
+
+export { redacted, isRedacted, getRedactedValue } from './redacted.js';

packages/typescript/src/utils/redacted.ts

@@ -0,0 +1,71 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+type RedactedRegistry = WeakMap<Redacted<any>, any>;
+
+const moduleRedactedRegistry: RedactedRegistry = new WeakMap();
+
+const REDACTED_REGISTRY_KEY = Symbol.for('@mysten/redacted/registry');
+function getRedactedRegistry() {
+	try {
+		const target = globalThis as {
+			[REDACTED_REGISTRY_KEY]?: RedactedRegistry;
+		};
+
+		if (!target[REDACTED_REGISTRY_KEY]) {
+			target[REDACTED_REGISTRY_KEY] = moduleRedactedRegistry;
+		}
+
+		return target[REDACTED_REGISTRY_KEY];
+	} catch (e) {
+		return moduleRedactedRegistry;
+	}
+}
+
+const RedactedType: unique symbol = Symbol.for('@mysten/redacted');
+export interface Redacted<T> {
+	[RedactedType]: T;
+}
+
+export function getRedactedValue<T>(redacted: Redacted<T>): T {
+	const redactedRegistry = getRedactedRegistry();
+
+	if (redactedRegistry.has(redacted)) {
+		return redactedRegistry.get(redacted) as T;
+	} else {
+		throw new Error('Unable to get redacted value');
+	}
+}
+
+export function redacted<T>(value: T): Redacted<T> {
+	const redactedRegistry = getRedactedRegistry();
+
+	const redacted = {
+		[RedactedType]: true,
+		[Symbol.toStringTag]: 'Redacted',
+		[Symbol.for('nodejs.util.inspect.custom')]: () => '<redacted>',
+		toString() {
+			return '<redacted>';
+		},
+		toJSON() {
+			return '<redacted>';
+		},
+	};
+
+	redactedRegistry.set(redacted, value);
+
+	return redacted as never;
+}
+
+export function isRedacted(value: any): value is Redacted<any> {
+	return typeof value === 'object' && Object.hasOwn(value, RedactedType);
+}
+
+/** @internal */
+export function getRedactedOrPlainValue<T>(value: T | Redacted<T>): T {
+	if (isRedacted(value)) {
+		return getRedactedValue(value);
+	}
+
+	return value;
+}