Struct MlDsaSecretKey 

pub struct MlDsaSecretKey { /* private fields */ }

ML-DSA secret key

Contains the private signing key for ML-DSA signatures. This key must be kept secret and is automatically zeroized when dropped.

Security Considerations

• Never expose secret keys in logs or error messages
• Store securely (encrypted at rest)
• Use secure channels for transmission
• Consider hardware security modules (HSMs) for production

Examples

use saorsa_pqc::api::sig::{ml_dsa_65, MlDsaSecretKey, MlDsaVariant};

let dsa = ml_dsa_65();
let (_, secret_key) = dsa.generate_keypair()?;

// Serialize for secure storage
let key_bytes = secret_key.to_bytes();
// Store key_bytes securely (encrypted)

// Later, restore from secure storage
let restored = MlDsaSecretKey::from_bytes(MlDsaVariant::MlDsa65, &key_bytes)?;

Implementations

impl MlDsaSecretKey

pub const fn variant(&self) -> MlDsaVariant

Get the variant of this key

pub fn to_bytes(&self) -> Vec<u8>

Export the secret key as bytes (handle with care!)

pub fn from_bytes( variant: MlDsaVariant, bytes: &[u8], ) -> Result<MlDsaSecretKey, PqcError>

Import a secret key from bytes

Errors

Returns an error if the byte slice has an incorrect length for the specified variant.

Trait Implementations

impl Clone for MlDsaSecretKey

fn clone(&self) -> MlDsaSecretKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Drop for MlDsaSecretKey

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl Zeroize for MlDsaSecretKey

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.