Enum KeriPublicKey 

pub enum KeriPublicKey {
    Ed25519 {
        key: [u8; 32],
        transferable: bool,
    },
    P256 {
        key: [u8; 33],
        transferable: bool,
    },
}

A validated KERI public key supporting Ed25519 and P-256.

Parsed from a CESR-qualified string. The derivation code prefix determines the curve, key size, and transferability.

Usage:

use auths_keri::KeriPublicKey;

// Ed25519 (D prefix, 32 bytes)
let key = KeriPublicKey::parse("DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA").unwrap();
assert_eq!(key.as_bytes().len(), 32);

// P-256 transferable uses the "1AAJ" prefix (33 bytes compressed SEC1).

Variants

Ed25519

Ed25519 public key (32 bytes).

transferable records which CESR code qualified it: D (true) is the rotating verkey code; B (false) is the non-transferable one used by KERI witnesses. Both decode to the same 32-byte key and verify with the same Ed25519 algorithm.

Fields

key: [u8; 32]

Raw Ed25519 public key (32 bytes).

transferable: bool

Whether the key was qualified with the transferable code (D).

P256

P-256 compressed public key (33 bytes, SEC1: 0x02/0x03 + x-coordinate).

transferable records which CESR code qualified it: 1AAJ (true) is the rotating verkey code; 1AAI (false) is the non-transferable one.

Fields

key: [u8; 33]

Compressed SEC1 point (33 bytes).

transferable: bool

Whether the key was qualified with the transferable code (1AAJ).

Implementations

impl KeriPublicKey

pub fn parse(encoded: &str) -> Result<Self, KeriDecodeError>

Parse a CESR-qualified key string, dispatching on the derivation code prefix.

• D prefix → Ed25519 transferable (32 bytes)
• B prefix → Ed25519 non-transferable (32 bytes) — the KERI witness code
• 1AAJ prefix → P-256 transferable (33 bytes compressed)
• 1AAI prefix → P-256 non-transferable (33 bytes compressed)

Per the CESR master code table, D/B and 1AAJ/1AAI are the transferable / non-transferable verkey codes for each curve. Both members of a pair decode to the same raw key; only the recorded transferability (and thus the rotation semantics) differ. Any other matter code returns Err(UnsupportedKeyType); malformed CESR returns Err(DecodeError).

pub fn as_bytes(&self) -> &[u8]

Returns the raw public key bytes (32 for Ed25519, 33 for P-256).

pub fn into_bytes(self) -> Vec<u8>

Consume self and return the raw bytes as a Vec.

pub fn curve(&self) -> CurveType

Returns the curve type.

pub fn raw_bytes(&self) -> &[u8]

The raw public-key bytes (32 for Ed25519, 33 compressed SEC1 for P-256) — paired with Self::curve so consumers dispatch on the typed curve and never re-match variants.

pub fn is_transferable(&self) -> bool

Whether this key is transferable (rotating).

Each variant carries the transferability recorded from its CESR code: Ed25519 from D/B, P-256 from 1AAJ/1AAI.

pub fn cesr_prefix(&self) -> &'static str

Returns the CESR derivation code prefix for this key type.

D/B for transferable / non-transferable Ed25519; 1AAJ/1AAI for transferable / non-transferable P-256 (per the CESR master code table).

pub fn to_qb64(&self) -> Result<String, KeriDecodeError>

Encode this key as a CESR-qualified qb64 string, byte-identical to keripy.

Ed25519 → D…; transferable P-256 → 1AAJ…; non-transferable P-256 → 1AAI…. This is the CESR-correct encoding (proper lead-byte alignment), not the legacy naive D + base64url(raw) form.

Usage:

let qb64 = key.to_qb64()?;

pub fn ed25519(bytes: &[u8]) -> Result<Self, KeriDecodeError>

Construct a transferable Ed25519 verkey from a 32-byte slice.

Ergonomic bridge for raw-byte sources (e.g. a ring public key) into the typed key. Returns Err(InvalidLength) if the slice is not 32 bytes.

Usage:

use auths_keri::KeriPublicKey;
let key = KeriPublicKey::ed25519(&[0u8; 32]).unwrap();
assert!(matches!(key, KeriPublicKey::Ed25519 { .. }));

pub fn from_verkey_bytes( bytes: &[u8], curve: CurveType, ) -> Result<Self, KeriDecodeError>

Construct a transferable verkey from raw bytes plus an explicit curve.

The complement of Self::as_bytes + Self::curve: rebuilds the typed key when you hold curve-tagged bytes (a CurveType carried alongside a Vec<u8>), instead of re-guessing the curve from byte length. Encodes as transferable (D / 1AAJ). Returns Err(InvalidLength) if the length doesn’t match the curve.

Usage:

use auths_keri::KeriPublicKey;
use auths_crypto::CurveType;
let key = KeriPublicKey::from_verkey_bytes(&[0u8; 32], CurveType::Ed25519).unwrap();
assert_eq!(key.curve(), CurveType::Ed25519);

pub fn verify_signature( &self, message: &[u8], signature: &[u8], ) -> Result<(), String>

Verify a signature against this public key.

Dispatches to the correct algorithm based on the key’s curve:

• Ed25519 → ring::signature::ED25519
• P-256 → p256::ecdsa (handles compressed SEC1 keys natively)

This method keeps the curve dispatch in one place so validation code doesn’t need to know about specific algorithms.

Trait Implementations

impl Clone for KeriPublicKey

fn clone(&self) -> KeriPublicKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeriPublicKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for KeriPublicKey

impl PartialEq for KeriPublicKey

fn eq(&self, other: &KeriPublicKey) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for KeriPublicKey