Class: Linzer::MLDSA::GemKey

Inherits:
Key
  • Object
show all
Defined in:
lib/linzer/ml_dsa/gem_key.rb

Overview

ML-DSA signing/verification backed by the ml_dsa gem (a C extension bundling the PQClean implementation).

Supports all three FIPS 204 parameter sets. Optional: not required by linzer.rb itself, and not a runtime dependency of the gemspec, callers who want this backend must add ml_dsa to their own Gemfile and require "linzer/ml_dsa/gem_key" themselves, which requires ml_dsa in turn.

See Also:

Instance Attribute Summary collapse

Attributes inherited from Key

#material

Instance Method Summary collapse

Methods inherited from Key

#key_id, #private?, #public?

Constructor Details

#initialize(material, params = {}) ⇒ GemKey

Returns a new instance of GemKey.



32
33
34
35
 
# File 'lib/linzer/ml_dsa/gem_key.rb', line 32

def initialize(material, params = {})
  @algorithm = String(params.fetch(:algorithm))
  super
end

Instance Attribute Details

#algorithm ⇒ Object (readonly)

Returns the value of attribute algorithm.



30
31
32
 
# File 'lib/linzer/ml_dsa/gem_key.rb', line 30

def algorithm
  @algorithm
end

Instance Method Details

#backend ⇒ Symbol

Returns :ml_dsa -- which backend produced this key.

Returns:

  • (Symbol) —

    :ml_dsa -- which backend produced this key



79
80
81
 
# File 'lib/linzer/ml_dsa/gem_key.rb', line 79

def backend
  :ml_dsa
end

#sign(data) ⇒ String

Signs an RFC 9421 signature base with an empty FIPS 204 context.

Parameters:

  • data (String) —

    Signature base bytes

Returns:

  • (String) —

    Raw FIPS 204 signature bytes

Raises:



55
56
57
58
59
60
 
# File 'lib/linzer/ml_dsa/gem_key.rb', line 55

def sign(data)
  validate_signing_key
  material.sign(data, context: "")
rescue MlDsa::Error => e
  raise SigningError, e.message, cause: e
end

#validate_signature_parameters(parameters) ⇒ true

Validates that the HTTP alg parameter matches this key's parameter set.

Parameters:

  • parameters (Hash) —

    HTTP signature parameters

Returns:

  • (true) —

    If alg is absent or matches this key

Raises:

  • (VerifyError) —

    If alg selects another ML-DSA parameter set



42
43
44
45
46
47
48
 
# File 'lib/linzer/ml_dsa/gem_key.rb', line 42

def validate_signature_parameters(parameters)
  supplied_algorithm = parameters["alg"] || parameters[:alg]
  return true if supplied_algorithm.nil? || supplied_algorithm == algorithm

  raise VerifyError,
    "Signature algorithm #{supplied_algorithm} does not match key algorithm #{algorithm}"
end

#verify(signature, data) ⇒ Boolean

Verifies an RFC 9421 signature base with an empty FIPS 204 context.

Parameters:

  • signature (String) —

    Raw FIPS 204 signature bytes

  • data (String) —

    Signature base bytes

Returns:

  • (Boolean) —

    Whether the signature is valid

Raises:

  • (VerifyError) —

    If public key material is unavailable



68
69
70
71
72
73
74
75
76
 
# File 'lib/linzer/ml_dsa/gem_key.rb', line 68

def verify(signature, data)
  validate_verify_key
  return false unless signature.is_a?(String)
  return false unless signature.bytesize == parameter_set.signature_bytes

  verification_material.verify(data, signature, context: "")
rescue MlDsa::Error, ArgumentError, TypeError
  false
end