Struct SecretKey

pub struct SecretKey<C: Curve> { /* private fields */ }

Elliptic curve secret keys.

This type wraps a secret scalar value, helping to prevent accidental exposure and securely erasing the value from memory when dropped.

Parsing PKCS#8 Keys

PKCS#8 is a commonly used format for encoding secret keys (especially ones generated by OpenSSL).

Keys in PKCS#8 format are either binary (ASN.1 BER/DER), or PEM encoded (ASCII) and begin with the following:

-----BEGIN PRIVATE KEY-----

To decode an elliptic curve private key from PKCS#8, enable the pkcs8 feature of this crate (or the pkcs8 feature of a specific RustCrypto elliptic curve crate) and use the DecodePrivateKey trait to parse it.

When the pem feature of this crate (or a specific RustCrypto elliptic curve crate) is enabled, a FromStr impl is also available.

Implementations

impl<C> SecretKey<C>

where C: Curve,

pub fn random(rng: &mut impl CryptoRngCore) -> Self

where C: CurveArithmetic,

Generate a random SecretKey.

pub fn new(scalar: ScalarPrimitive<C>) -> Self

Create a new secret key from a scalar value.

pub fn as_scalar_primitive(&self) -> &ScalarPrimitive<C>

Borrow the inner secret ScalarPrimitive value.

⚠️ Warning

This value is key material.

Please treat it with the care it deserves!

pub fn to_nonzero_scalar(&self) -> NonZeroScalar<C>

where C: CurveArithmetic,

Get the secret NonZeroScalar value for this key.

⚠️ Warning

This value is key material.

Please treat it with the care it deserves!

pub fn public_key(&self) -> PublicKey<C>

where C: CurveArithmetic,

Get the PublicKey which corresponds to this secret key

pub fn from_bytes(bytes: &FieldBytes<C>) -> Result<Self>

Deserialize secret key from an encoded secret scalar.

pub fn from_slice(slice: &[u8]) -> Result<Self>

Deserialize secret key from an encoded secret scalar passed as a byte slice.

The slice is expected to be a minimum of 24-bytes (192-byts) and at most C::FieldBytesSize bytes in length.

Byte slices shorter than the field size are handled by zero padding the input.

pub fn to_bytes(&self) -> FieldBytes<C>

Serialize raw secret scalar as a big endian integer.

pub fn from_sec1_der(der_bytes: &[u8]) -> Result<Self>

where C: Curve + ValidatePublicKey, FieldBytesSize<C>: ModulusSize,

Deserialize secret key encoded in the SEC1 ASN.1 DER ECPrivateKey format.

pub fn to_sec1_der(&self) -> Result<Zeroizing<Vec<u8>>>

where C: CurveArithmetic, AffinePoint<C>: FromEncodedPoint<C> + ToEncodedPoint<C>, FieldBytesSize<C>: ModulusSize,

Serialize secret key in the SEC1 ASN.1 DER ECPrivateKey format.

pub fn from_sec1_pem(s: &str) -> Result<Self>

where C: Curve + ValidatePublicKey, FieldBytesSize<C>: ModulusSize,

Parse SecretKey from PEM-encoded SEC1 ECPrivateKey format.

PEM-encoded SEC1 keys can be identified by the leading delimiter:

-----BEGIN EC PRIVATE KEY-----

pub fn to_sec1_pem(&self, line_ending: LineEnding) -> Result<Zeroizing<String>>

where C: CurveArithmetic, AffinePoint<C>: FromEncodedPoint<C> + ToEncodedPoint<C>, FieldBytesSize<C>: ModulusSize,

Serialize private key as self-zeroizing PEM-encoded SEC1 ECPrivateKey with the given pem::LineEnding.

Pass Default::default() to use the OS’s native line endings.

Trait Implementations

impl<C> AssociatedAlgorithmIdentifier for SecretKey<C>

where C: AssociatedOid + Curve,

const ALGORITHM_IDENTIFIER: AlgorithmIdentifier<ObjectIdentifier> = _

AlgorithmIdentifier for this structure.

type Params = ObjectIdentifier

Algorithm parameters.

impl<C: Clone + Curve> Clone for SecretKey<C>

fn clone(&self) -> SecretKey<C>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<C> ConstantTimeEq for SecretKey<C>

where C: Curve,

fn ct_eq(&self, other: &Self) -> Choice

Determine if two items are equal.

fn ct_ne(&self, other: &Self) -> Choice

Determine if two items are NOT equal.

impl<C> Debug for SecretKey<C>

where C: Curve,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<C> Drop for SecretKey<C>

where C: Curve,

fn drop(&mut self)

Executes the destructor for this type.

impl<C> EncodePrivateKey for SecretKey<C>

where C: AssociatedOid + CurveArithmetic, AffinePoint<C>: FromEncodedPoint<C> + ToEncodedPoint<C>, FieldBytesSize<C>: ModulusSize,

fn to_pkcs8_der(&self) -> Result<SecretDocument>

Serialize a SecretDocument containing a PKCS#8-encoded private key.

fn to_pkcs8_pem( &self, line_ending: LineEnding, ) -> Result<Zeroizing<String>, Error>

Serialize this private key as PEM-encoded PKCS#8 with the given LineEnding.

fn write_pkcs8_der_file(&self, path: impl AsRef<Path>) -> Result<(), Error>

Write ASN.1 DER-encoded PKCS#8 private key to the given path

fn write_pkcs8_pem_file( &self, path: impl AsRef<Path>, line_ending: LineEnding, ) -> Result<(), Error>

Write ASN.1 DER-encoded PKCS#8 private key to the given path

impl<C> From<&NonZeroScalar<C>> for SecretKey<C>

where C: CurveArithmetic,

fn from(scalar: &NonZeroScalar<C>) -> SecretKey<C>

Converts to this type from the input type.

impl<C> From<&SecretKey<C>> for NonZeroScalar<C>

where C: CurveArithmetic,

fn from(sk: &SecretKey<C>) -> NonZeroScalar<C>

Converts to this type from the input type.

impl<C> From<NonZeroScalar<C>> for SecretKey<C>

where C: CurveArithmetic,

fn from(scalar: NonZeroScalar<C>) -> SecretKey<C>

Converts to this type from the input type.

impl<C> From<SecretKey<C>> for NonZeroScalar<C>

where C: CurveArithmetic,

fn from(sk: SecretKey<C>) -> NonZeroScalar<C>

Converts to this type from the input type.

impl<C> FromStr for SecretKey<C>

where C: Curve + AssociatedOid + ValidatePublicKey, FieldBytesSize<C>: ModulusSize,

type Err = Error

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self>

Parses a string s to return a value of this type.

impl<C> PartialEq for SecretKey<C>

where C: Curve,

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<C> TryFrom<EcPrivateKey<'_>> for SecretKey<C>

where C: Curve + ValidatePublicKey, FieldBytesSize<C>: ModulusSize,

type Error = Error

The type returned in the event of a conversion error.

fn try_from(sec1_private_key: EcPrivateKey<'_>) -> Result<Self>

Performs the conversion.

impl<C> TryFrom<PrivateKeyInfo<'_>> for SecretKey<C>

where C: AssociatedOid + Curve + ValidatePublicKey, FieldBytesSize<C>: ModulusSize,

type Error = Error

The type returned in the event of a conversion error.

fn try_from(private_key_info: PrivateKeyInfo<'_>) -> Result<Self>

Performs the conversion.

impl<C: Curve> Eq for SecretKey<C>

impl<C> ZeroizeOnDrop for SecretKey<C>

where C: Curve,