Struct Ed25519SecretKey

Source

pub struct Ed25519SecretKey { /* private fields */ }

Expand description

Ed25519 secret key

§Security

This type contains secret key material that must be kept confidential:

Store securely (encrypted at rest)
Transmit securely (TLS/encrypted channels)
Clear from memory after use (automatic via Drop)
Never log or display the key material

The internal representation includes both the seed and expanded key material. Only the seed needs to be stored for persistence.

Implementations§

Source §

impl Ed25519SecretKey

Source

pub fn from_seed(seed: &[u8; 32]) -> ApiResult<Self>

Create a secret key from a 32-byte seed

This is useful when loading keys from storage. The seed is expanded using SHA-512 and the appropriate bits are clamped as per RFC 8032.

§Security

Only use seeds from trusted sources
Ensure seeds were generated with a cryptographic RNG
Never use predictable or low-entropy seeds
Validate seed integrity if loading from storage

§Example

use dcrypt_sign::eddsa::{Ed25519, Ed25519SecretKey};
use dcrypt_api::Signature;

// Load seed from storage (example uses fixed bytes)
let seed = [42u8; 32];
 
// Reconstruct secret key
let secret = Ed25519SecretKey::from_seed(&seed)?;
 
// Can now derive public key
let public = secret.public_key()?;
 
// Or use for signing
let message = b"test";
let signature = Ed25519::sign(message, &secret)?;

Source

pub fn seed(&self) -> &[u8; 32]

Get the 32-byte seed value

This is the original random seed before expansion. This is what should be stored when saving keys to persistent storage.

§Security

Encrypt seeds before storing to disk
Use secure key derivation if password-protecting
Clear seed arrays from memory after use
Never log or transmit seeds over insecure channels

Source

pub fn export_seed(&self) -> Zeroizing<Vec<u8>>

Export the seed as a Zeroizing vector for secure handling

Source

pub fn public_key(&self) -> ApiResult<Ed25519PublicKey>

Get the public key corresponding to this secret key

This derives the public key on-demand from the secret key material. The derivation is deterministic, so calling this multiple times will always return the same public key.

§Example

use dcrypt_sign::eddsa::Ed25519;
use dcrypt_api::Signature;
use rand::rngs::OsRng;

let mut rng = OsRng;
let (_, secret) = Ed25519::keypair(&mut rng)?;
 
// Get public key from secret key
let public = secret.public_key()?;
 
// Can use it for verification
let message = b"test message";
let signature = Ed25519::sign(message, &secret)?;
assert!(Ed25519::verify(message, &signature, &public).is_ok());