Class: SecretKey

Defined in: keys.ts:199

A secret key (KEM or signature), held in WASM memory. Call SecretKey.free (or use using) when finished: it wipes the key material. Never log or serialize it casually.

Copies you extract with SecretKey.exportBytes, toCbor() or toPem() live in the JavaScript heap, outside this library's control; wipe them with wipe() after use.

Accessors

algorithm

Get Signature

get algorithm(): string

Defined in: keys.ts:250

Canonical algorithm string, e.g. X25519+ML-KEM-768.

Throws

if the key has been freed.

Returns

string

---

migrationState

Get Signature

get migrationState(): MigrationState

Defined in: keys.ts:257

Migration state recorded with the key.

Throws

if the key has been freed.

Returns

MigrationState

Methods

[dispose]()

[dispose](): void

Defined in: keys.ts:293

Supports using key = ...; calls SecretKey.free.

Returns

void

---

exportBytes()

exportBytes(): Uint8Array

Defined in: keys.ts:264

Copies the raw secret key bytes out of WASM memory. Wipe the copy after use.

Returns

Uint8Array

Throws

if the key has been freed.

---

free()

free(): void

Defined in: keys.ts:289

Wipes and releases the key material in WASM memory. The object is unusable afterwards. Calling it again does nothing.

Returns

void

---

toCbor()

toCbor(): Uint8Array

Defined in: keys.ts:271

CBOR serialization. Contains the secret; handle accordingly.

Returns

Uint8Array

Throws

if the key has been freed.

---

toJSON()

toJSON(): object

Defined in: keys.ts:301

Never reveals key material.

Returns

object

redacted

redacted: true

type

type: "SecretKey"

---

toPem()

toPem(): string

Defined in: keys.ts:278

PEM serialization. Contains the secret; handle accordingly.

Returns

string

Throws

if the key has been freed.

---

toString()

toString(): string

Defined in: keys.ts:297

Never reveals key material. Prints the algorithm, or freed after SecretKey.free.

Returns

string

---

fromBytes()

static fromBytes(algorithm, raw, migrationState?): SecretKey

Defined in: keys.ts:216

Builds a secret key from its raw bytes (for example read from a quantum-safe-py key). The bytes are copied into WASM memory; wipe your copy. The length is not checked here; a wrong length surfaces when the key is used.

Parameters

algorithm

string

Canonical algorithm string.

raw

Uint8Array

Raw secret key bytes in quantum-safe-py wire layout.

migrationState?

MigrationState

State to record with the key. Default: hybrid_transition for hybrid names and X-Wing, pqc_only otherwise.

Returns

SecretKey

The secret key.

Throws

if algorithm is not a string, raw is empty or not bytes, or migrationState is unknown.

---

fromCbor()

static fromCbor(data): SecretKey

Defined in: keys.ts:230

Parses to_cbor() output of quantum-safe-py or this library. The CBOR contains the secret.

Parameters

data

Uint8Array

CBOR-encoded secret key.

Returns

SecretKey

The secret key.

Throws

if data is not a valid CBOR secret key (a public key is rejected too).

Throws

if the key was written by a newer format version.

Throws

if data exceeds the 10 MB limit.

Throws

if data is not bytes.

---

fromPem()

static fromPem(pem): SecretKey

Defined in: keys.ts:242

Parses a QUANTUM SAFE SECRET KEY PEM. The PEM text itself contains the secret.

Parameters

pem

string

PEM text.

Returns

SecretKey

The secret key.

Throws

if pem is not a valid PEM secret key (a public key PEM is rejected too).

Throws

if the key was written by a newer format version.

Throws

if pem exceeds the 10 MB limit.

Throws

if pem is not a string.