Struct HybridSecretKey 

pub struct HybridSecretKey {
    pub classical_sk: StaticSecret,
    pub ml_kem_dk: Box<<MlKem768 as KemCore>::DecapsulationKey>,
}

Hybrid secret key. Holds the classical long-term secret (X25519 by default, ECDH-P-256 under fips) and the ML-KEM-768 decapsulation key. Both halves are zeroized on drop — ml_kem’s DecapsulationKey implements Zeroize natively, and the classical side either uses x25519_dalek’s Zeroize impl (default) or aws-lc-rs’s internal Drop, which frees the underlying key material.

ml_kem_dk is Box-ed so the (~2.4 KiB) decapsulation key lives on the heap; constructing several HybridSecretKeys in a deep call chain (as happens during the handshake) would otherwise stress tokio’s default test thread stack.

Fields

classical_sk: StaticSecret

Classical long-lived secret. Type depends on the active backend: x25519_dalek::StaticSecret (default) or aws_lc_rs::agreement::PrivateKey (--features fips, ECDH-P-256).

ml_kem_dk: Box<<MlKem768 as KemCore>::DecapsulationKey>

ML-KEM-768 decapsulation key (FIPS 203). Boxed to keep stack pressure down — the structure is ~2.4 KiB.

Implementations

impl HybridSecretKey

pub fn generate() -> (Self, HybridKeyPackage)

pub fn decapsulate( &self, ciphertext: &HybridCiphertext, ) -> Result<[u8; 32], Error>

Trait Implementations

impl Debug for HybridSecretKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for HybridSecretKey

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.