Struct SecretKey

Source

pub struct SecretKey { /* private fields */ }

Expand description

A 32-byte secret key with automatic zeroization.

§Security

This type ensures that key material is securely erased from memory when the value is dropped. Key material never appears in debug output.

Important: This type intentionally does not implement Clone to prevent accidental duplication of secret key material. Keys must be moved, not copied.

§Example

use txgate_crypto::keys::SecretKey;

// Generate a new random key
let key = SecretKey::generate();

// Keys are automatically zeroized when dropped
drop(key);

Implementations§

Source §

impl SecretKey

Source

pub const fn new(bytes: [u8; 32]) -> Self

Create a new SecretKey from raw bytes.

§Arguments

bytes - The 32-byte secret key material

§Security

The input bytes are copied into the SecretKey. The caller should zeroize the original bytes if they are no longer needed.

§Example

use txgate_crypto::keys::SecretKey;
use zeroize::Zeroize;

let mut raw_bytes = [0x42u8; 32];
let key = SecretKey::new(raw_bytes);

// Zeroize the original bytes for security
raw_bytes.zeroize();

Source

pub fn generate() -> Self

Generate a new random SecretKey using a cryptographically secure RNG.

This uses the operating system’s secure random number generator (OsRng) to generate the key material.

§Example

use txgate_crypto::keys::SecretKey;

let key = SecretKey::generate();
assert_eq!(key.len(), 32);

Source

pub const fn as_bytes(&self) -> &[u8; 32]

Expose the raw bytes for cryptographic operations.

§Security

The returned reference must not be stored or copied beyond the immediate cryptographic operation. Misuse can lead to key material remaining in memory longer than intended.

§Example

use txgate_crypto::keys::SecretKey;

let key = SecretKey::generate();
let bytes = key.as_bytes();
assert_eq!(bytes.len(), 32);

Source

pub const fn len(&self) -> usize

Get the length of the secret key in bytes.

Always returns 32 for this key type.

Source

pub const fn is_empty(&self) -> bool

Returns false (SecretKey is never empty).

This method exists for API consistency and always returns false.

Source

pub fn into_k256(self) -> Result<SecretKey, SecretKeyError>

Convert this SecretKey into a k256::SecretKey for secp256k1 operations.

§Security

This method consumes self to ensure the key material exists in only one place. After calling this method, the original SecretKey is zeroized and cannot be used.

§Errors

Returns an error if the bytes do not represent a valid secp256k1 scalar (e.g., if the value is zero or greater than the curve order).

§Example

use txgate_crypto::keys::SecretKey;

let key = SecretKey::generate();
match key.into_k256() {
    Ok(k256_key) => {
        // Use k256_key for signing
    }
    Err(e) => {
        // Handle invalid key (very rare with generated keys)
    }
}