pub struct MlDsa87SecretKey { /* private fields */ }Expand description
An expanded ML-DSA-87 secret key.
This is the only way to sign. Key generation runs once, in
MlDsa87SecretKey::new or MlDsa87SecretKey::generate, and the
resulting matrix A and secret vectors in the NTT domain are cached, so
signing does not repeat the expensive key generation.
The key is a plain fixed-size value (about ML_DSA_87_SECRET_KEY_SIZE
bytes) that never allocates, which makes it usable on no_std and embedded
targets.
Secrets are zeroized on drop when the zeroize feature is enabled.
Implementations§
Source§impl MlDsa87SecretKey
impl MlDsa87SecretKey
Sourcepub fn new(seed: &[u8; 32]) -> Self
pub fn new(seed: &[u8; 32]) -> Self
Expands seed into a secret key, running the full FIPS 204 key
generation and caching the NTT-domain matrix and secret vectors.
Sourcepub fn generate() -> Self
pub fn generate() -> Self
Generates a random secret key.
The seed can be retrieved afterwards with MlDsa87SecretKey::seed
so it can be persisted.
Sourcepub fn public_key(&self) -> MlDsa87PublicKey
pub fn public_key(&self) -> MlDsa87PublicKey
Returns the public key for this secret key.
Sourcepub fn sign(&self, message: &[u8], ctx: &[u8]) -> Result<[u8; 4627], MlDsaError>
pub fn sign(&self, message: &[u8], ctx: &[u8]) -> Result<[u8; 4627], MlDsaError>
Signs message with a fresh random nonce.
ctx is the optional FIPS 204 context string and must be at most 255
bytes; it returns MlDsaError::ContextTooLong otherwise.
Sourcepub fn sign_derand(
&self,
message: &[u8],
ctx: &[u8],
rnd: &[u8; 32],
) -> Result<[u8; 4627], MlDsaError>
pub fn sign_derand( &self, message: &[u8], ctx: &[u8], rnd: &[u8; 32], ) -> Result<[u8; 4627], MlDsaError>
Signs message deterministically for a fixed 32-byte rnd.
Passing rnd = [0u8; 32] gives the deterministic FIPS 204 variant;
any other value gives the hedged/randomized variant. ctx must be at
most 255 bytes, returning MlDsaError::ContextTooLong otherwise.
Sourcepub fn sign_external_mu(&self, mu: &[u8; 64]) -> [u8; 4627]
pub fn sign_external_mu(&self, mu: &[u8; 64]) -> [u8; 4627]
Signs a precomputed 64-byte message representative mu (FIPS 204
“external mu” signing) with a fresh random nonce.
mu must be the output of the FIPS 204 message-representative
computation; this function performs no domain separation or hashing.