Struct DilithiumKeyPair 

pub struct DilithiumKeyPair { /* private fields */ }

An ML-DSA key pair (private key + public key).

The private key bytes are automatically zeroized on drop (FIPS 204 §7).

Type aliases: MlDsaKeyPair (FIPS 204 naming) = DilithiumKeyPair (legacy).

Implementations

impl DilithiumKeyPair

pub fn generate(mode: DilithiumMode) -> Result<Self, DilithiumError>

Generate a new key pair using OS entropy (FIPS 204 §6.1 KeyGen).

Requires the std or getrandom feature (enabled by default).

pub fn generate_deterministic(mode: DilithiumMode, seed: &[u8; 32]) -> Self

Generate a key pair deterministically from a seed.

pub fn sign( &self, msg: &[u8], ctx: &[u8], ) -> Result<DilithiumSignature, DilithiumError>

Sign a message using pure ML-DSA (FIPS 204 §6.1 ML-DSA.Sign).

Context string ctx is optional (max 255 bytes). Requires the std or getrandom feature for randomized signing.

pub fn sign_prehash( &self, msg: &[u8], ctx: &[u8], ) -> Result<DilithiumSignature, DilithiumError>

Sign a message using HashML-DSA (FIPS 204 §6.2 HashML-DSA.Sign).

The message is internally hashed with SHA-512 before signing. Context string ctx is optional (max 255 bytes). Requires the std or getrandom feature for randomized signing.

pub fn sign_deterministic( &self, msg: &[u8], ctx: &[u8], rnd: &[u8; 32], ) -> Result<DilithiumSignature, DilithiumError>

Sign deterministically (for testing / reproducibility).

pub fn verify( pk: &[u8], sig: &DilithiumSignature, msg: &[u8], ctx: &[u8], mode: DilithiumMode, ) -> bool

Verify a pure ML-DSA signature (FIPS 204 §6.1 ML-DSA.Verify).

pub fn verify_prehash( pk: &[u8], sig: &DilithiumSignature, msg: &[u8], ctx: &[u8], mode: DilithiumMode, ) -> bool

Verify a HashML-DSA signature (FIPS 204 §6.2 HashML-DSA.Verify).

pub fn public_key(&self) -> &[u8]

Get the encoded public key bytes.

pub fn private_key(&self) -> &[u8]

Get the encoded private key bytes.

pub fn mode(&self) -> DilithiumMode

Get the security mode.

pub fn from_keys( privkey: &[u8], pubkey: &[u8], mode: DilithiumMode, ) -> Result<Self, DilithiumError>

Reconstruct from private + public key bytes with validation (FIPS 204 §7.1).

Validates that:

1. Key sizes match the expected values for the given mode.
2. The public key embedded in the secret key is consistent.
3. The secret key’s tr = H(pk) field is consistent.

pub fn to_bytes(&self) -> Vec<u8>

Serialize the full key pair to bytes: [mode_tag(1) | pk | sk].

The mode tag encodes the security level so deserialization can automatically select the correct parameters.

pub fn from_bytes(data: &[u8]) -> Result<Self, DilithiumError>

Deserialize a key pair from the format produced by to_bytes.

pub fn public_key_bytes(&self) -> Vec<u8>

Export only the public key bytes with a mode tag: [mode_tag(1) | pk].

pub fn from_public_key( data: &[u8], ) -> Result<(DilithiumMode, Vec<u8>), DilithiumError>

Create a verify-only handle from tagged public key bytes.

Trait Implementations

impl Clone for DilithiumKeyPair

fn clone(&self) -> DilithiumKeyPair

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DilithiumKeyPair

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for DilithiumKeyPair

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for DilithiumKeyPair

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.