Struct KeyPair 

pub struct KeyPair<PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize> {
    pub public_key: PublicKey,
    pub secret_key: SecretKey,
}

Public/secret keypair for use with crate::dryocbox::DryocBox and libsodium-compatible public-key encryption.

Fields

public_key: PublicKey

Public key

secret_key: SecretKey

Secret key

Implementations

impl KeyPair<Locked<HeapByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>, Locked<HeapByteArray<CRYPTO_BOX_SECRETKEYBYTES>>>

pub fn new_locked_keypair() -> Result<Self, Error>

Available on crate feature protected only.

Returns a new zero-filled locked keypair.

Errors

Returns Error::Io if either allocation cannot be locked, commonly because the process has reached its locked-memory limit.

Panics

Panics if either page-aligned allocation cannot be created or its size cannot be represented with guard pages.

pub fn generate_locked_keypair() -> Result<Self, Error>

Available on crate feature protected only.

Returns a new randomly generated locked keypair.

Errors

Returns Error::Io if either allocation cannot be locked.

Panics

Panics if either page-aligned allocation cannot be created, its size cannot be represented with guard pages, or the operating system’s random number generator fails.

pub fn gen_locked_keypair() -> Result<Self, Error>

👎Deprecated:

use generate_locked_keypair() instead

Available on crate feature protected only.

Returns a new randomly generated locked keypair.

Prefer generate_locked_keypair. This method is retained for compatibility.

Errors

Returns the same errors as generate_locked_keypair.

Panics

Panics under the same conditions as generate_locked_keypair.

pub fn precalculate_locked<OtherPublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>( &self, third_party_public_key: &OtherPublicKey, ) -> Result<PrecalcSecretKey<Locked<HeapByteArray<CRYPTO_BOX_BEFORENMBYTES>>>, Error>

Available on crate feature protected only.

Computes a heap-allocated, page-aligned, locked shared secret key using a secret key from this keypair and third_party_public_key.

Compatible with libsodium’s crypto_box_beforenm.

Errors

Returns an error if third_party_public_key is an unacceptable low-order point or the shared-key allocation cannot be locked.

Panics

Panics if the page-aligned shared-key allocation cannot be created or its size cannot be represented with guard pages.

impl KeyPair<LockedRO<HeapByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>, LockedRO<HeapByteArray<CRYPTO_BOX_SECRETKEYBYTES>>>

pub fn generate_readonly_locked_keypair() -> Result<Self, Error>

Available on crate feature protected only.

Returns a new randomly generated locked, read-only keypair.

Errors

Returns Error::Io if either allocation cannot be locked or its page permissions cannot be changed to read-only.

Panics

Panics if either page-aligned allocation cannot be created, its size cannot be represented with guard pages, or the operating system’s random number generator fails.

pub fn gen_readonly_locked_keypair() -> Result<Self, Error>

👎Deprecated:

use generate_readonly_locked_keypair() instead

Available on crate feature protected only.

Returns a new randomly generated locked, read-only keypair.

Prefer generate_readonly_locked_keypair. This method is retained for compatibility.

Errors

Returns the same errors as generate_readonly_locked_keypair.

Panics

Panics under the same conditions as generate_readonly_locked_keypair.

pub fn precalculate_readonly_locked<OtherPublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>( &self, third_party_public_key: &OtherPublicKey, ) -> Result<PrecalcSecretKey<LockedRO<HeapByteArray<CRYPTO_BOX_BEFORENMBYTES>>>, Error>

Available on crate feature protected only.

Computes a heap-allocated, page-aligned, locked, read-only shared secret key using a secret key from this keypair and third_party_public_key.

Compatible with libsodium’s crypto_box_beforenm.

Errors

Returns an error if third_party_public_key is an unacceptable low-order point, the shared-key allocation cannot be locked, or its page permissions cannot be changed to read-only.

Panics

Panics if the page-aligned shared-key allocation cannot be created or its size cannot be represented with guard pages.

impl<PublicKey: NewByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: NewByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize> KeyPair<PublicKey, SecretKey>

pub fn new() -> Self

Creates a new, empty keypair.

pub fn generate() -> Self

Generates a random keypair.

pub fn gen() -> Self

👎Deprecated:

use generate() instead

Generates a random keypair.

Prefer generate. gen is retained for compatibility with older Rust editions.

pub fn from_secret_key(secret_key: SecretKey) -> Self

Derives the public key for secret_key and returns the complete keypair, consuming the secret key.

pub fn from_seed<Seed: ByteArray<CRYPTO_BOX_SEEDBYTES>>(seed: &Seed) -> Self

Deterministically derives a keypair from seed.

impl KeyPair<StackByteArray<CRYPTO_BOX_PUBLICKEYBYTES>, StackByteArray<CRYPTO_BOX_SECRETKEYBYTES>>

pub fn generate_with_defaults() -> Self

Randomly generates a new keypair, using default types (stack-allocated byte arrays). Provided for convenience.

pub fn gen_with_defaults() -> Self

👎Deprecated:

use generate_with_defaults() instead

Randomly generates a new keypair, using default types (stack-allocated byte arrays). Provided for convenience.

Prefer generate_with_defaults. This method is retained for compatibility.

impl<'a, PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + TryFrom<&'a [u8]> + Zeroize, SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + TryFrom<&'a [u8]> + Zeroize> KeyPair<PublicKey, SecretKey>

pub fn from_slices( public_key: &'a [u8], secret_key: &'a [u8], ) -> Result<Self, Error>

Constructs a new keypair from key slices, consuming them. Does not check validity or authenticity of keypair.

Errors

Returns an error if either slice does not have the required key length, or if the target key type rejects the key bytes.

impl<PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize> KeyPair<PublicKey, SecretKey>

pub fn is_valid_public_key<PK: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>( key: &PK, ) -> bool

Checks if the given public key is valid according to X25519 rules.

For X25519 (crypto_box, DryocBox), this performs a trial scalar multiplication and rejects public keys that produce an all-zero shared secret, including low-order inputs rejected by libsodium. As required by RFC 7748, the high bit of the encoded public key is ignored.

Validating Protected Keys

You can validate keys stored in protected memory directly, as the validation functions operate on references.

use dryoc::constants::{CRYPTO_BOX_PUBLICKEYBYTES, CRYPTO_BOX_SECRETKEYBYTES};
use dryoc::keypair::protected::{HeapByteArray, LockedRO};
use dryoc::keypair::{KeyPair, PublicKey, SecretKey};

// Generate a keypair stored in locked, read-only memory
let protected_kp: KeyPair<
    LockedRO<HeapByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>,
    LockedRO<HeapByteArray<CRYPTO_BOX_SECRETKEYBYTES>>,
> = KeyPair::generate_readonly_locked_keypair().expect("Failed to generate locked keypair");

// Validate the X25519 public key.
let is_x25519_valid = KeyPair::<
    LockedRO<HeapByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>,
    LockedRO<HeapByteArray<CRYPTO_BOX_SECRETKEYBYTES>>,
>::is_valid_public_key(&protected_kp.public_key);

assert!(is_x25519_valid, "Protected X25519 key should be valid");

pub fn is_valid_ed25519_key<PK: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>( key: &PK, ) -> bool

Checks if the given key is a valid prime-order Ed25519 public key.

The canonical compressed encoding is required. The high bit, which encodes the sign of the x-coordinate, may legitimately be set.

This is a strict prime-subgroup policy, not a generic Ed25519 signature validity predicate. Use it when an application or point-arithmetic protocol requires canonical, nonidentity, prime-order keys. Verify signatures with crypto_sign_verify_detached instead; some signature profiles intentionally define different point-acceptance rules. is_valid_public_key should be used for X25519 keys used in crypto_box.

pub fn kx_new_client_session<SessionKey: NewByteArray<CRYPTO_KX_SESSIONKEYBYTES> + Zeroize + ZeroizeOnDrop>( &self, server_public_key: &PublicKey, ) -> Result<Session<SessionKey>, Error>

Creates new client session keys using this keypair and server_public_key, assuming this keypair is for the client.

Errors

Returns an error if server_public_key is unacceptable, including a low-order point that would produce an all-zero shared secret.

pub fn kx_new_server_session<SessionKey: NewByteArray<CRYPTO_KX_SESSIONKEYBYTES> + Zeroize + ZeroizeOnDrop>( &self, client_public_key: &PublicKey, ) -> Result<Session<SessionKey>, Error>

Creates new server session keys using this keypair and client_public_key, assuming this keypair is for the server.

Errors

Returns an error if client_public_key is unacceptable, including a low-order point that would produce an all-zero shared secret.

pub fn precalculate( &self, third_party_public_key: &PublicKey, ) -> Result<PrecalcSecretKey<StackByteArray<CRYPTO_BOX_BEFORENMBYTES>>, Error>

Computes a stack-allocated shared secret key using a secret key from this keypair and third_party_public_key.

Compatible with libsodium’s crypto_box_beforenm.

Errors

Returns an error if third_party_public_key is an unacceptable low-order point.

Trait Implementations

impl<PublicKey: Clone + ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: Clone + ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize> Clone for KeyPair<PublicKey, SecretKey>

fn clone(&self) -> KeyPair<PublicKey, SecretKey>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize> Debug for KeyPair<PublicKey, SecretKey>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<PublicKey: NewByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: NewByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize> Default for KeyPair<PublicKey, SecretKey>

fn default() -> Self

Returns the “default value” for a type.

impl<'de, PublicKey, SecretKey> Deserialize<'de> for KeyPair<PublicKey, SecretKey>

where PublicKey: Deserialize<'de> + ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: Deserialize<'de> + ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize> Drop for KeyPair<PublicKey, SecretKey>

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl<PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize> PartialEq for KeyPair<PublicKey, SecretKey>

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl<PublicKey, SecretKey> Serialize for KeyPair<PublicKey, SecretKey>

where PublicKey: Serialize + ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize, SecretKey: Serialize + ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl<PublicKey, SecretKey> Zeroize for KeyPair<PublicKey, SecretKey>

where PublicKey: Zeroize + ByteArray<CRYPTO_BOX_PUBLICKEYBYTES>, SecretKey: Zeroize + ByteArray<CRYPTO_BOX_SECRETKEYBYTES>,

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.