quantum-safe-ts

Appearance

Class: StandardKeyPair ​

Defined in: standard.ts:35

A standards-mode ML-DSA key pair: the FIPS 204 public key and the 32-byte seed it is derived from.

The seed is FIPS 204's native secret-key form (the expanded secret key is derived from it), and it is what RFC 9964 stores in the private AKP JWK. It is held in WebAssembly memory and wiped by StandardKeyPair.free (or using).

Interoperability. A standard FIPS 204 signature made with this key verifies anywhere (quantum-safe-py verify_raw, any FIPS 204 library). The reverse has one limit: a secret key that quantum-safe-py generated through liboqs is a 4,032-byte expanded key from which no seed can be recovered, so quantum-safe-ts cannot sign with it. It can verify everything that key signs. Keys generated by quantum-safe-py's cryptography backend, or by this class, are seed keys and work in both libraries.

Example ​

ts
const signer = new Sign('ML-DSA-65');
using pair = signer.generateStandardKeyPair();
const sig = signer.signRaw(utf8('release 1.2.3'), pair, { context: utf8('myapp-release') });
signer.verifyRaw(utf8('release 1.2.3'), sig, pair.publicKey, { context: utf8('myapp-release') });

Properties ​

algorithm ​

readonly algorithm: StandardAlgorithm

Defined in: standard.ts:37

ML-DSA-44, ML-DSA-65 or ML-DSA-87.

publicKey ​

readonly publicKey: Uint8Array

Defined in: standard.ts:39

FIPS 204 encoded public key (1312 / 1952 / 2592 bytes). Not secret.

Methods ​

[dispose]() ​

[dispose](): void

Defined in: standard.ts:76

Supports using pair = ...; calls StandardKeyPair.free.

Returns ​

void

exportSeed() ​

exportSeed(): Uint8Array

Defined in: standard.ts:67

Copies the 32-byte seed out of WebAssembly memory. Wipe the copy after use (seed.fill(0)).

Returns ​

Uint8Array

A copy of the seed.

Throws ​

if the pair has been freed.

free() ​

free(): void

Defined in: standard.ts:72

Wipes the seed. Using the pair afterwards throws InvalidArgumentError. Calling it again does nothing.

Returns ​

void

toJSON() ​

toJSON(): object

Defined in: standard.ts:85

JSON form used by JSON.stringify: the algorithm and a placeholder in place of the public key. Neither seed nor key bytes appear.

Returns ​

object

algorithm ​

algorithm: StandardAlgorithm

publicKey ​

publicKey: string

toString() ​

toString(): string

Defined in: standard.ts:81

Short description with the algorithm; the seed is not shown.

Returns ​

string

Apache-2.0.