Use sanitizing containers in hkdf_streaming_prf

PiperOrigin-RevId: 302873823

4 files changed, 15 insertions, 7 deletions

diff --git a/cc/prf/BUILD.bazel b/cc/prf/BUILD.bazel
index 9d59aa7b0..dac36f203 100644
--- a/cc/prf/BUILD.bazel
+++ b/cc/prf/BUILD.bazel
@@ -10,17 +10,18 @@ cc_library(
     include_prefix = "tink/prf",
     deps = [
         "//:core/key_type_manager",
+        "//proto:common_cc_proto",
+        "//proto:hkdf_prf_cc_proto",
+        "//proto:tink_cc_proto",
         "//subtle",
         "//subtle/prf:hkdf_streaming_prf",
         "//subtle/prf:streaming_prf",
         "//util:constants",
         "//util:enums",
+        "//util:secret_data",
         "//util:status",
         "//util:statusor",
         "//util:validation",
-        "//proto:common_cc_proto",
-        "//proto:hkdf_prf_cc_proto",
-        "//proto:tink_cc_proto",
     ],
 )
 
@@ -33,8 +34,8 @@ cc_library(
     deps = [
         ":hkdf_prf_key_manager",
         "//:registry",
-        "//util:status",
         "//proto:tink_cc_proto",
+        "//util:status",
     ],
 )
 
@@ -56,11 +57,12 @@ cc_test(
     srcs = ["hkdf_prf_key_manager_test.cc"],
     deps = [
         ":hkdf_prf_key_manager",
+        "//proto:common_cc_proto",
         "//subtle",
         "//subtle/prf:hkdf_streaming_prf",
         "//util:input_stream_util",
+        "//util:secret_data",
         "//util:test_matchers",
-        "//proto:common_cc_proto",
         "@com_google_googletest//:gtest_main",
     ],
 )
diff --git a/cc/prf/CMakeLists.txt b/cc/prf/CMakeLists.txt
index c41ee571f..882b5df83 100644
--- a/cc/prf/CMakeLists.txt
+++ b/cc/prf/CMakeLists.txt
@@ -12,6 +12,7 @@ tink_cc_library(
     tink::subtle::prf::streaming_prf
     tink::util::constants
     tink::util::enums
+    tink::util::secret_data
     tink::util::status
     tink::util::statusor
     tink::util::validation
@@ -52,6 +53,7 @@ tink_cc_test(
     tink::subtle::prf::streaming_prf
     tink::subtle::subtle
     tink::util::input_stream_util
+    tink::util::secret_data
     tink::util::test_matchers
     tink::util::test_util
     tink::proto::common_cc_proto
diff --git a/cc/prf/hkdf_prf_key_manager.h b/cc/prf/hkdf_prf_key_manager.h
index c2fbc27f5..bf4b13018 100644
--- a/cc/prf/hkdf_prf_key_manager.h
+++ b/cc/prf/hkdf_prf_key_manager.h
@@ -23,6 +23,7 @@
 #include "tink/subtle/random.h"
 #include "tink/util/constants.h"
 #include "tink/util/enums.h"
+#include "tink/util/secret_data.h"
 #include "tink/util/status.h"
 #include "tink/util/statusor.h"
 #include "tink/util/validation.h"
@@ -43,7 +44,7 @@ class HkdfPrfKeyManager
         const google::crypto::tink::HkdfPrfKey& key) const override {
       return subtle::HkdfStreamingPrf::New(
           crypto::tink::util::Enums::ProtoToSubtle(key.params().hash()),
-          key.key_value(), key.params().salt());
+          util::SecretDataFromStringView(key.key_value()), key.params().salt());
     }
   };
 
diff --git a/cc/prf/hkdf_prf_key_manager_test.cc b/cc/prf/hkdf_prf_key_manager_test.cc
index 0892f094c..2e82a123d 100644
--- a/cc/prf/hkdf_prf_key_manager_test.cc
+++ b/cc/prf/hkdf_prf_key_manager_test.cc
@@ -19,6 +19,7 @@
 #include "tink/subtle/common_enums.h"
 #include "tink/subtle/prf/hkdf_streaming_prf.h"
 #include "tink/util/input_stream_util.h"
+#include "tink/util/secret_data.h"
 #include "tink/util/test_matchers.h"
 #include "proto/common.pb.h"
 
@@ -215,7 +216,9 @@ TEST(HkdfPrfKeyManagerTest, CreatePrf) {
 
   StatusOr<std::unique_ptr<StreamingPrf>> direct_prf =
       subtle::HkdfStreamingPrf::New(
-          subtle::SHA256, key_or.ValueOrDie().key_value(), "salt string");
+          subtle::SHA256,
+          util::SecretDataFromStringView(key_or.ValueOrDie().key_value()),
+          "salt string");
 
   ASSERT_THAT(direct_prf.status(), IsOk());