Variable: Upgrader
constUpgrader:object
Defined in: migrate.ts:130
Upgrades classical keys to hybrid post-quantum keys.
Type Declaration
checkNeedsUpgrade()
readonlycheckNeedsUpgrade(keyOrState):boolean
True if the key is still classical_only and should be upgraded. Accepts a key pair or a state.
Parameters
keyOrState
A key pair (its public key's migration state is used) or a MigrationState.
Returns
boolean
Whether the state is classical_only.
describeKey()
readonlydescribeKey(keyPair):object
Describes a key's migration status for reports and dashboards. Never includes secret material.
Parameters
keyPair
The key pair to describe; only its public key is read.
Returns
object
The algorithm, state, whether it is a packed hybrid, whether it needs an upgrade, the public-key fingerprint and size in bytes, and a recommendation for the next step.
algorithm
algorithm:
string
fingerprint
fingerprint:
string
isHybrid
isHybrid:
boolean
migrationState
migrationState:
MigrationState
needsUpgrade
needsUpgrade:
boolean
publicKeySize
publicKeySize:
number
recommendation
recommendation:
string
stripClassicalComponent()
readonlystripClassicalComponent(keyPair):KeyPair
Removes the classical half of a hybrid key pair, producing a PQC-only pair in pqc_only state. One-way: classical clients can no longer use the result. Log the action in your migration audit trail.
The classical secret bytes are wiped from the temporary copies made here. The input key pair is not modified or freed; free it separately.
Parameters
keyPair
A packed hybrid key pair (a name of the form <classical>+<pqc>, not X-Wing).
Returns
A new key pair holding only the post-quantum keys, with the algorithm name of the post-quantum half and the state pqc_only.
Throws
if the key pair is not hybrid.
upgradeKemKey()
readonlyupgradeKemKey(input):UpgradeResult
Adds a fresh post-quantum KEM key to an existing classical KEM key. The classical key bytes are kept unchanged inside the hybrid key, so the same X25519/P-256 identity continues. Both halves are required by this library's own HybridKEM.
The new key is round-tripped (encapsulate, then decapsulate) before it is returned, which catches a classical public key that does not belong to the secret.
Parameters
input
The classical key bytes, the classical algorithm (default X25519) and the post-quantum KEM (default ML-KEM-768).
Returns
The hybrid key pair (free it, or use using), the old and new algorithm names, the state hybrid_transition and notes.
Throws
for wrong key lengths, for a classical key pair that fails the round trip, or for input that is not bytes.
Throws
for an unapproved pairing.
upgradeSigningKey()
readonlyupgradeSigningKey(input):UpgradeResult
Adds a fresh post-quantum signing key to an existing classical signing key. The classical key is retained unchanged. New signatures carry both sub-signatures and verifiers must accept both; existing classical-only signatures do not verify as hybrid signatures.
The new key signs and verifies one byte before it is returned, which catches a classical public key that does not belong to the secret.
Parameters
input
The classical key bytes, the classical algorithm (default Ed25519) and the post-quantum algorithm (default ML-DSA-65).
Returns
The hybrid key pair (free it, or use using), the old and new algorithm names, the state hybrid_transition and notes.
Throws
for wrong key lengths, for a classical key pair that fails the self-test, or for input that is not bytes.
Throws
for an unapproved pairing.
Example
const result = Upgrader.upgradeKemKey({ classicalSecret, classicalPublic }); // X25519 + ML-KEM-768
using pair = result.keyPair;
console.log(result.newAlgorithm, result.migrationState); // "X25519+ML-KEM-768" "hybrid_transition"