Struct PrivateKey 

pub struct PrivateKey { /* private fields */ }

A validated secp256k1 private key that zeroizes its bytes on drop.

Created by generate. The key is guaranteed to be a valid scalar in the range [1, n-1] where n is the secp256k1 curve order.

When this value goes out of scope, the underlying bytes are securely overwritten with zeros to prevent secrets from lingering in memory.

The 32 bytes live in a heap buffer behind a Box, so moving a PrivateKey moves a pointer rather than memcpying the key into a fresh stack slot that nothing would ever erase. Constructors fill that buffer in place for the same reason: the key material is never staged in a bare [u8; 32] local.

Implementations

impl PrivateKey

pub fn as_bytes(&self) -> &[u8; 32]

Returns a reference to the raw 32-byte private key.

pub fn to_secret_key(&self) -> SecretKey

Converts the private key into a secp256k1::SecretKey for use with the secp256k1 crate directly.

The returned type is outside this crate’s erasure guarantees: SecretKey is Copy, does not erase itself when dropped, and its non_secure_erase is best-effort. Keep the value short-lived, erase it by hand, and treat every copy of it as key material.

pub fn to_hex(&self) -> SecretKeyHex

Encodes the key as 64 lowercase hexadecimal ASCII bytes.

The result is a SecretKeyHex: it erases itself on drop and redacts its Debug output. The digits are written straight into that buffer, so encoding a key allocates nothing beyond the buffer itself and leaves no unerased temporaries on the heap.

Example

let hex = "0000000000000000000000000000000000000000000000000000000000000001";
let key = btc_keygen::PrivateKey::from_hex(hex)?;
assert_eq!(key.to_hex().expose_str(), hex);

pub fn from_bytes(bytes: [u8; 32]) -> Result<PrivateKey, Error>

Creates a PrivateKey from 32 raw bytes, validating that they form a valid secp256k1 scalar.

Use this when you have your own source of private key material (for example, physical entropy like dice rolls converted to hex) and want to skip OS entropy generation.

bytes is Copy, so the caller keeps its own array; erasing that copy is the caller’s job. This function erases the copy it receives.

Errors

Returns Error if bytes is zero or greater than or equal to the secp256k1 curve order n.

Example

let mut bytes = [0u8; 32];
bytes[31] = 0x01;
let key = btc_keygen::PrivateKey::from_bytes(bytes)?;

pub fn from_hex(hex: &str) -> Result<PrivateKey, Error>

Creates a PrivateKey from a 64-character hexadecimal string, validating that the decoded bytes form a valid secp256k1 scalar.

Convenience wrapper around from_bytes for callers that have the key material as a hex string (for example, from a CLI argument or a text file).

Errors

Returns Error if:

• hex is not exactly 64 characters long.
• hex contains a character that is not a valid hexadecimal digit.
• The decoded bytes are zero or greater than or equal to the secp256k1 curve order n.

Example

let hex = "0000000000000000000000000000000000000000000000000000000000000001";
let key = btc_keygen::PrivateKey::from_hex(hex)?;

Trait Implementations

impl Drop for PrivateKey

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl Zeroize for PrivateKey

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.