pub struct SecretKey { /* private fields */ }
Expand description

A seceret key for use with Ristretto Schnorr signatures.

Internally, these consist of a scalar mod l along with a seed for nonce generation. In this way, we ensure all scalar arithmatic works smoothly in operations like threshold or multi-signatures, or hierarchical deterministic key derivations.

We keep our secret key serializaion “almost” compatable with EdDSA “expanded” secret key serializaion by multiplying the scalar by the cofactor 8, as integers, and dividing on deserializaion. We do not however attempt to keep the scalar’s high bit set, especially not during hierarchical deterministic key derivations, so some Ed25519 libraries might compute the public key incorrectly from our secret key.

Implementations

Convert this SecretKey into an array of 64 bytes with.

Returns an array of 64 bytes, with the first 32 bytes being the secret scalar represented cannonically, and the last 32 bytes being the seed for nonces.

Examples
use schnorrkel::{MiniSecretKey, SecretKey};

let mini_secret_key: MiniSecretKey = MiniSecretKey::generate();
let secret_key: SecretKey = mini_secret_key.expand(MiniSecretKey::UNIFORM_MODE);
let secret_key_bytes: [u8; 64] = secret_key.to_bytes();
let bytes: [u8; 64] = secret_key.to_bytes();
let secret_key_again: SecretKey = SecretKey::from_bytes(&bytes[..]).unwrap();
assert_eq!(&bytes[..], & secret_key_again.to_bytes()[..]);

Construct an SecretKey from a slice of bytes.

Examples
use schnorrkel::{MiniSecretKey, SecretKey, ExpansionMode, SignatureError};

let mini_secret_key: MiniSecretKey = MiniSecretKey::generate();
let secret_key: SecretKey = mini_secret_key.expand(MiniSecretKey::ED25519_MODE); 
let bytes: [u8; 64] = secret_key.to_bytes();
let secret_key_again: SecretKey = SecretKey::from_bytes(&bytes[..]).unwrap();
assert_eq!(secret_key_again, secret_key);

Convert this SecretKey into an array of 64 bytes, corresponding to an Ed25519 expanded secret key.

Returns an array of 64 bytes, with the first 32 bytes being the secret scalar shifted ed25519 style, and the last 32 bytes being the seed for nonces.

Construct an SecretKey from a slice of bytes, corresponding to an Ed25519 expanded secret key.

Example
use schnorrkel::{SecretKey, SECRET_KEY_LENGTH};
use hex_literal::hex;

let secret = hex!("28b0ae221c6bb06856b287f60d7ea0d98552ea5a16db16956849aa371db3eb51fd190cce74df356432b410bd64682309d6dedb27c76845daf388557cbac3ca34");
let public = hex!("46ebddef8cd9bb167dc30878d7113b7e168e6f0646beffd77d69d39bad76b47a");
let secret_key = SecretKey::from_ed25519_bytes(&secret[..]).unwrap();
assert_eq!(secret_key.to_public().to_bytes(), public);

Generate an “unbiased” SecretKey directly from a user suplied csprng uniformly, bypassing the MiniSecretKey layer.

Generate an “unbiased” SecretKey directly, bypassing the MiniSecretKey layer.

Derive the PublicKey corresponding to this SecretKey.

Derive the PublicKey corresponding to this SecretKey.

Sign a transcript with this SecretKey.

Requires a SigningTranscript, normally created from a SigningContext and a message, as well as the public key correspodning to self. Returns a Schnorr signature.

We employ a randomized nonce here, but also incorporate the transcript like in a derandomized scheme, but only after first extending the transcript by the public key. As a result, there should be no attacks even if both the random number generator fails and the function gets called with the wrong public key.

Sign a message with this SecretKey, but doublecheck the result.

Sign a message with this SecretKey.

Sign a message with this SecretKey, but doublecheck the result.

Evaluate the VRF-like multiplication on an uncompressed point, probably not useful in this form.

Evaluate the VRF-like multiplication on a compressed point, useful for proving key exchanges, OPRFs, or sequential VRFs.

We caution that such protocols could provide signing oracles and note that vrf_create_from_point cannot check for problematic inputs like attach_input_hash does.

Vaguely BIP32-like “hard” derivation of a MiniSecretKey from a SecretKey

We do not envision any “good reasons” why these “hard” derivations should ever be used after the soft Derivation trait. We similarly do not believe hard derivations make any sense for ChainCodes or ExtendedKeys types. Yet, some existing BIP32 workflows might do these things, due to BIP32’s de facto stnadardization and poor design. In consequence, we provide this method to do “hard” derivations in a way that should work with all BIP32 workflows and any permissible mutations of SecretKey. This means only that we hash the SecretKey’s scalar, but not its nonce becuase the secret key remains valid if the nonce is changed.

Trait Implementations

Returns a copy of the value. Read more

Performs copy-assignment from source. Read more

Determine if two items are equal. Read more

Formats the value using the given formatter. Read more

Derive key with subkey identified by a byte array presented via a SigningTranscript, and a chain code. Read more

Derive key with subkey identified by a byte array and a chain code. We do not include a context here becuase the chain code could serve this purpose. Read more

Derive key with subkey identified by a byte array and a chain code, and with external ranodmnesses. Read more

Deserialize this value from the given Serde deserializer. Read more

Executes the destructor for this type. Read more

Performs the conversion.

Performs the conversion.

This method tests for self and other values to be equal, and is used by ==. Read more

This method tests for !=.

Serialize this value into the given Serde serializer. Read more

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler. Read more

Auto Trait Implementations

Blanket Implementations

Gets the TypeId of self. Read more

Immutably borrows from an owned value. Read more

Mutably borrows from an owned value. Read more

Returns the argument unchanged.

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Should always be Self

The resulting type after obtaining ownership.

Creates owned data from borrowed data, usually by cloning. Read more

🔬 This is a nightly-only experimental API. (toowned_clone_into)

Uses borrowed data to replace owned data, usually by cloning. Read more

The type returned in the event of a conversion error.

Performs the conversion.

The type returned in the event of a conversion error.

Performs the conversion.