Struct MlDsa44Key 

pub struct MlDsa44Key { /* private fields */ }

An ML-DSA-44 private key for mldsa44 signing (DKIM2 only, draft-ietf-dkim-dkim2-spec Section 3.4).

Signatures use “pure” ML-DSA-44 (FIPS 204) with the DKIM2 context string. They are hedged (randomized), as the specification recommends, so signing the same input twice gives different signatures.

Implementations

impl MlDsa44Key

pub fn generate_pkcs8() -> Result<Vec<u8>>

Generates a new random key and returns it as PKCS #8 DER bytes (the RFC 9881 seed-only private key encoding), ready for from_pkcs8_der.

Errors

Returns Error::Crypto with CryptoError::Library if the system random number generator fails.

pub fn from_pkcs8_der(pkcs8_der: &[u8]) -> Result<Self>

Loads a key from PKCS #8 DER bytes holding an ML-DSA-44 private key in the RFC 9881 seed-only or both (seed and expanded key) form. The key is derived from the seed.

Errors

Returns Error::Crypto with CryptoError::Library if the key cannot be decoded or has no seed.

pub fn from_raw_private_key(raw: &[u8]) -> Result<Self>

Loads a key from its 32-byte seed.

Errors

Returns Error::Crypto with CryptoError::Library if the seed has the wrong length or cannot be expanded.

pub fn public_key(&self) -> Result<Vec<u8>>

Returns the 1312-byte ML-DSA-44 public key, as published in the p= tag of a k=mldsa44 key record.

Errors

Returns Error::Crypto with CryptoError::Library if the backend cannot export the public key.

Trait Implementations

impl From<MlDsa44Key> for DkimKey

Available on crate features aws-lc-rs or rust-crypto only.

fn from(key: MlDsa44Key) -> Self

Converts to this type from the input type.

impl SigningKey for MlDsa44Key

type Hasher = Sha256

The hash function used by the signature algorithm.

fn sign(&self, input: impl Writable) -> Result<Vec<u8>>

Signs the bytes written by input and returns the raw signature.

fn algorithm(&self) -> Algorithm

Returns the signature algorithm written to the a= tag.

fn heap_size(&self) -> usize

Approximate heap memory owned by the key, in bytes, for weighing cache entries that hold it.

fn hash(&self, data: impl Writable) -> HashOutput

Hashes the bytes written by data with Self::Hasher.