Enum Key 

pub enum Key<'a> {
    Secret(SecretKey<'a>),
    Ed25519Public(PublicKey),
    Ed25519Secret(SecretKey),
    P256Public(PublicKey),
    P256Secret(SecretKey),
    P384Public(PublicKey),
    P521Public(PublicKey),
    P521Secret(SecretKey),
    Rsa(RsaPublicKey),
    MlDsa44Public(MlDsa44PublicKey),
    MlDsa44Secret(MlDsa44SecretKey),
    MlDsa65Public(MlDsa65PublicKey),
    MlDsa65Secret(Box<MlDsa65SecretKey>),
    MlDsa87Public(MlDsa87PublicKey),
    MlDsa87Secret(Box<MlDsa87SecretKey>),
}

A JWK decoded into a concrete cryptographic key.

This is the entry point when the key type is only known at runtime, for example after fetching a JWKS document. Key::try_from inspects the JWK’s kty (and crv) to select the right variant, so callers do not need to know in advance whether the key is RSA, EC, OKP, …

When a JWK carries both public and secret material (for example one produced from a secret key), the secret variant is preferred.

Key implements both Signer and Verifier, so a decoded key can be passed directly to sign or parse_and_verify. Public-only keys return Error::InvalidKey when signing.

Errors

Key::try_from returns Error::InvalidKey if the JWK’s key material is inconsistent with its declared algorithm, if the curve or algorithm is unsupported, or if the underlying key bytes are invalid.

Variants

Secret(SecretKey<'a>)

Symmetric key for the BLAKE3, HS256, HS384, and HS512 algorithms.

Ed25519Public(PublicKey)

Ed25519 public key for EdDSA.

Ed25519Secret(SecretKey)

Ed25519 secret key for EdDSA.

P256Public(PublicKey)

P-256 public key for ES256.

P256Secret(SecretKey)

P-256 secret key for ES256.

P384Public(PublicKey)

P-384 public key for ES384.

P521Public(PublicKey)

P-521 public key for ES512.

P521Secret(SecretKey)

P-521 secret key for ES512.

Rsa(RsaPublicKey)

RSA public key for the RS* and PS* algorithms.

MlDsa44Public(MlDsa44PublicKey)

ML-DSA-44 public key for ML-DSA-44.

MlDsa44Secret(MlDsa44SecretKey)

ML-DSA-44 secret key for ML-DSA-44.

MlDsa65Public(MlDsa65PublicKey)

ML-DSA-65 public key for ML-DSA-65.

MlDsa65Secret(Box<MlDsa65SecretKey>)

ML-DSA-65 secret key for ML-DSA-65.

Boxed because an expanded ML-DSA-65 secret key is roughly 50 KiB, which would otherwise inflate every Key value and overflow the stack in debug builds.

MlDsa87Public(MlDsa87PublicKey)

ML-DSA-87 public key for ML-DSA-87.

MlDsa87Secret(Box<MlDsa87SecretKey>)

ML-DSA-87 secret key for ML-DSA-87.

Boxed because an expanded ML-DSA-87 secret key is roughly 82 KiB, which would otherwise inflate every Key value and overflow the stack in debug builds.

Implementations

impl Key<'_>

pub fn is_secret_key(&self) -> bool

Returns true if the Key is a secret key that can be used for signing.

Trait Implementations

impl Debug for Key<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Signer for Key<'_>

fn sign(&self, message: &[u8]) -> Result<Signature, Error>

fn algorithm(&self) -> Algorithm

impl<'a> TryFrom<&'a Jwk> for Key<'a>

type Error = Error

The type returned in the event of a conversion error.

fn try_from(jwk: &'a Jwk) -> Result<Self, Self::Error>

Performs the conversion.

impl Verifier for Key<'_>

fn verify(&self, message: &[u8], signature: &[u8]) -> Result<(), Error>

fn algorithm(&self) -> Algorithm