Struct KeyPair 

pub struct KeyPair { /* private fields */ }

A Falcon-512 keypair with a zeroizing secret key.

The secret key bytes are zeroed in memory when the KeyPair is dropped, using zeroize.

Serialization

When the serde feature is enabled, KeyPair serializes only the public key. The secret key is never written to any serialized form; this is intentional. To persist a secret key, use KeyPair::secret_key_bytes and store the bytes in an encrypted wallet or HSM.

Thread Safety

KeyPair is Send but not Sync because the underlying FrSecretKey does not implement Sync. Wrap in a Mutex for shared use across threads.

Implementations

impl KeyPair

pub fn generate() -> Self

Generate a new Falcon-512 keypair using the OS random number generator.

Keygen is computationally expensive (~10 ms on a typical server CPU). Pre-generate keys and cache them when throughput matters.

pub fn from_bytes(sk_bytes: &[u8], pk_bytes: &[u8]) -> Result<Self, Error>

Reconstruct a KeyPair from raw secret key and public key bytes.

Both inputs are validated for length. The public key is not mathematically verified against the secret key — callers are responsible for ensuring the pair is consistent.

pub fn public_key(&self) -> &PublicKey

Return a reference to the public key.

pub fn secret_key_bytes(&self) -> &[u8]

Return the raw secret key bytes.

Handle the returned slice with care. Do not log, serialize, or store it in plaintext. Prefer storing in an encrypted wallet.

pub fn sign(&self, message: &[u8]) -> Vec<u8>

Sign a message with this keypair.

Internally, the function computes:

digest = SHA3-256(FALCON_MULTISIG_V1: || message)
signature = Falcon512::sign(digest, secret_key)

The returned bytes are the raw Falcon-512 signature (variable length, up to [SIGNATURE_MAX_BYTES] bytes). The digest is not appended; callers hold the message and recompute the digest during verification.

Errors

Returns Error::InvalidPublicKeyLength if the stored key is somehow malformed (should never occur for keys produced by KeyPair::generate).

pub fn address(&self) -> SingleKeyAddress

Derive the canonical single-key address from this keypair.

pub fn verify_own_signature( &self, message: &[u8], signature: &[u8], ) -> Result<bool, Error>

Verify that a raw signature was produced by this keypair’s secret key over the given message.

Trait Implementations

impl Debug for KeyPair

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for KeyPair

Available on crate feature serde only.

fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error>

Serialize this value into the given Serde serializer.