Module: PQCrypto

Defined in:
lib/pq_crypto.rb,
lib/pq_crypto/kem.rb,
lib/pq_crypto/spki.rb,
lib/pq_crypto/pkcs8.rb,
lib/pq_crypto/errors.rb,
lib/pq_crypto/version.rb,
lib/pq_crypto/signature.rb,
lib/pq_crypto/hybrid_kem.rb,
lib/pq_crypto/serialization.rb,
lib/pq_crypto/algorithm_registry.rb,
ext/pqcrypto/pqcrypto_ruby_secure.c

Defined Under Namespace

Modules: AlgorithmRegistry, HybridKEM, KEM, NativeBindings, PKCS8, SPKI, Serialization, Signature, Testing Classes: Error, InvalidCiphertextError, InvalidKeyError, SerializationError, UnsupportedAlgorithmError, VerificationError

Constant Summary collapse

SUITES = 
{
  kem: AlgorithmRegistry.supported_kems,
  hybrid_kem: AlgorithmRegistry.supported_hybrid_kems,
  signature: AlgorithmRegistry.supported_signatures,
}.freeze
NATIVE_EXTENSION_LOADED = 
true
VERSION = 
"0.4.0"
ML_KEM_512_PUBLIC_KEY_BYTES = 
INT2NUM(MLKEM512_PUBLICKEYBYTES)
ML_KEM_512_SECRET_KEY_BYTES = 
INT2NUM(MLKEM512_SECRETKEYBYTES)
ML_KEM_512_CIPHERTEXT_BYTES = 
INT2NUM(MLKEM512_CIPHERTEXTBYTES)
ML_KEM_512_SHARED_SECRET_BYTES = 
INT2NUM(MLKEM512_SHAREDSECRETBYTES)
ML_KEM_PUBLIC_KEY_BYTES = 
INT2NUM(PQ_MLKEM_PUBLICKEYBYTES)
ML_KEM_SECRET_KEY_BYTES = 
INT2NUM(PQ_MLKEM_SECRETKEYBYTES)
ML_KEM_CIPHERTEXT_BYTES = 
INT2NUM(PQ_MLKEM_CIPHERTEXTBYTES)
ML_KEM_SHARED_SECRET_BYTES = 
INT2NUM(PQ_MLKEM_SHAREDSECRETBYTES)
ML_KEM_1024_PUBLIC_KEY_BYTES = 
INT2NUM(MLKEM1024_PUBLICKEYBYTES)
ML_KEM_1024_SECRET_KEY_BYTES = 
INT2NUM(MLKEM1024_SECRETKEYBYTES)
ML_KEM_1024_CIPHERTEXT_BYTES = 
INT2NUM(MLKEM1024_CIPHERTEXTBYTES)
ML_KEM_1024_SHARED_SECRET_BYTES = 
INT2NUM(MLKEM1024_SHAREDSECRETBYTES)
HYBRID_KEM_PUBLIC_KEY_BYTES = 
INT2NUM(PQ_HYBRID_PUBLICKEYBYTES)
HYBRID_KEM_SECRET_KEY_BYTES = 
INT2NUM(PQ_HYBRID_SECRETKEYBYTES)
HYBRID_KEM_CIPHERTEXT_BYTES = 
INT2NUM(PQ_HYBRID_CIPHERTEXTBYTES)
HYBRID_KEM_SHARED_SECRET_BYTES = 
INT2NUM(PQ_HYBRID_SHAREDSECRETBYTES)
SIGN_44_PUBLIC_KEY_BYTES = 
INT2NUM(MLDSA44_PUBLICKEYBYTES)
SIGN_44_SECRET_KEY_BYTES = 
INT2NUM(MLDSA44_SECRETKEYBYTES)
SIGN_44_BYTES = 
INT2NUM(MLDSA44_BYTES)
SIGN_PUBLIC_KEY_BYTES = 
INT2NUM(PQ_MLDSA_PUBLICKEYBYTES)
SIGN_SECRET_KEY_BYTES = 
INT2NUM(PQ_MLDSA_SECRETKEYBYTES)
SIGN_BYTES = 
INT2NUM(PQ_MLDSA_BYTES)
SIGN_87_PUBLIC_KEY_BYTES = 
INT2NUM(MLDSA87_PUBLICKEYBYTES)
SIGN_87_SECRET_KEY_BYTES = 
INT2NUM(MLDSA87_SECRETKEYBYTES)
SIGN_87_BYTES = 
INT2NUM(MLDSA87_BYTES)

Class Method Summary collapse

Class Method Details

.__test_ml_dsa_44_keypair_from_seed(seed) ⇒ Object 



1013
1014
1015
1016
1017
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1013

static VALUE pqcrypto__test_ml_dsa_44_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    return pq_run_test_sign_keypair_from_seed(pq_testing_mldsa_44_keypair_nogvl, seed,
                                              MLDSA44_PUBLICKEYBYTES, MLDSA44_SECRETKEYBYTES);
}

.__test_ml_dsa_44_sign_from_seed(message, secret_key, seed) ⇒ Object 



1078
1079
1080
1081
1082
1083
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1078

static VALUE pqcrypto__test_ml_dsa_44_sign_from_seed(VALUE self, VALUE message, VALUE secret_key,
                                                     VALUE seed) {
    (void)self;
    return pq_run_test_sign_from_seed(pq_testing_mldsa_44_sign_nogvl, message, secret_key, seed,
                                      MLDSA44_SECRETKEYBYTES, MLDSA44_BYTES);
}

.__test_ml_dsa_87_keypair_from_seed(seed) ⇒ Object 



1019
1020
1021
1022
1023
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1019

static VALUE pqcrypto__test_ml_dsa_87_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    return pq_run_test_sign_keypair_from_seed(pq_testing_mldsa_87_keypair_nogvl, seed,
                                              MLDSA87_PUBLICKEYBYTES, MLDSA87_SECRETKEYBYTES);
}

.__test_ml_dsa_87_sign_from_seed(message, secret_key, seed) ⇒ Object 



1085
1086
1087
1088
1089
1090
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1085

static VALUE pqcrypto__test_ml_dsa_87_sign_from_seed(VALUE self, VALUE message, VALUE secret_key,
                                                     VALUE seed) {
    (void)self;
    return pq_run_test_sign_from_seed(pq_testing_mldsa_87_sign_nogvl, message, secret_key, seed,
                                      MLDSA87_SECRETKEYBYTES, MLDSA87_BYTES);
}

.__test_ml_kem_1024_encapsulate_from_seed(public_key, seed) ⇒ Object 



903
904
905
906
907
908
909
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 903

static VALUE pqcrypto__test_ml_kem_1024_encapsulate_from_seed(VALUE self, VALUE public_key,
                                                              VALUE seed) {
    (void)self;
    return pq_run_test_kem_encapsulate_from_seed(
        pq_testing_ml_kem_1024_encapsulate_nogvl, public_key, seed, MLKEM1024_PUBLICKEYBYTES,
        MLKEM1024_CIPHERTEXTBYTES, MLKEM1024_SHAREDSECRETBYTES);
}

.__test_ml_kem_512_encapsulate_from_seed(public_key, seed) ⇒ Object 



895
896
897
898
899
900
901
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 895

static VALUE pqcrypto__test_ml_kem_512_encapsulate_from_seed(VALUE self, VALUE public_key,
                                                             VALUE seed) {
    (void)self;
    return pq_run_test_kem_encapsulate_from_seed(
        pq_testing_ml_kem_512_encapsulate_nogvl, public_key, seed, MLKEM512_PUBLICKEYBYTES,
        MLKEM512_CIPHERTEXTBYTES, MLKEM512_SHAREDSECRETBYTES);
}

.__test_ml_kem_encapsulate_from_seed(public_key, seed) ⇒ Object 



819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 819

static VALUE pqcrypto__test_ml_kem_encapsulate_from_seed(VALUE self, VALUE public_key, VALUE seed) {
    (void)self;
    pq_validate_bytes_argument(public_key, PQ_MLKEM_PUBLICKEYBYTES, "public key");
    StringValue(seed);

    if ((size_t)RSTRING_LEN(seed) != 32) {
        rb_raise(rb_eArgError, "Deterministic test seed must be 32 bytes");
    }

    kem_encapsulate_call_t call = {0};
    size_t public_key_len = 0;
    size_t seed_len = 0;
    call.public_key = pq_copy_ruby_string(public_key, &public_key_len);
    call.ciphertext = pq_alloc_buffer(PQ_MLKEM_CIPHERTEXTBYTES);
    call.shared_secret = pq_alloc_buffer(PQ_MLKEM_SHAREDSECRETBYTES);
    call.seed = pq_copy_ruby_string(seed, &seed_len);
    call.seed_len = seed_len;

    rb_thread_call_without_gvl(pq_testing_ml_kem_encapsulate_nogvl, &call, NULL, NULL);
    pq_wipe_and_free((uint8_t *)call.public_key, public_key_len);
    pq_wipe_and_free((uint8_t *)call.seed, call.seed_len);

    if (call.result != PQ_SUCCESS) {
        pq_wipe_and_free(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES);
        free(call.ciphertext);
        pq_raise_general_error(call.result);
    }

    VALUE result = rb_ary_new2(2);
    rb_ary_push(result, pq_string_from_buffer(call.ciphertext, PQ_MLKEM_CIPHERTEXTBYTES));
    rb_ary_push(result, pq_string_from_buffer(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES));

    free(call.ciphertext);
    pq_wipe_and_free(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES);
    return result;
}

.__test_ml_kem_keypair_from_seed(seed) ⇒ Object 



786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 786

static VALUE pqcrypto__test_ml_kem_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    StringValue(seed);

    if ((size_t)RSTRING_LEN(seed) != 64) {
        rb_raise(rb_eArgError, "Deterministic ML-KEM test seed must be 64 bytes (FIPS 203 d||z)");
    }

    kem_keypair_call_t call = {0};
    size_t seed_len = 0;
    call.public_key = pq_alloc_buffer(PQ_MLKEM_PUBLICKEYBYTES);
    call.secret_key = pq_alloc_buffer(PQ_MLKEM_SECRETKEYBYTES);
    call.seed = pq_copy_ruby_string(seed, &seed_len);
    call.seed_len = seed_len;

    rb_thread_call_without_gvl(pq_testing_ml_kem_keypair_nogvl, &call, NULL, NULL);
    pq_wipe_and_free((uint8_t *)call.seed, call.seed_len);

    if (call.result != PQ_SUCCESS) {
        pq_wipe_and_free(call.secret_key, PQ_MLKEM_SECRETKEYBYTES);
        free(call.public_key);
        pq_raise_general_error(call.result);
    }

    VALUE result = rb_ary_new2(2);
    rb_ary_push(result, pq_string_from_buffer(call.public_key, PQ_MLKEM_PUBLICKEYBYTES));
    rb_ary_push(result, pq_string_from_buffer(call.secret_key, PQ_MLKEM_SECRETKEYBYTES));

    free(call.public_key);
    pq_wipe_and_free(call.secret_key, PQ_MLKEM_SECRETKEYBYTES);
    return result;
}

.__test_sign_from_seed(message, secret_key, seed) ⇒ Object 



944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 944

static VALUE pqcrypto__test_sign_from_seed(VALUE self, VALUE message, VALUE secret_key,
                                           VALUE seed) {
    (void)self;
    pq_validate_bytes_argument(secret_key, PQ_MLDSA_SECRETKEYBYTES, "secret key");
    StringValue(seed);

    if ((size_t)RSTRING_LEN(seed) != 32) {
        rb_raise(rb_eArgError, "Deterministic test seed must be 32 bytes");
    }

    sign_call_t call = {0};
    size_t secret_key_len = 0;
    size_t seed_len = 0;
    call.secret_key = pq_copy_ruby_string(secret_key, &secret_key_len);
    call.signature_len = PQ_MLDSA_BYTES;
    call.signature = pq_alloc_buffer(PQ_MLDSA_BYTES);
    call.message = pq_copy_ruby_string(message, &call.message_len);
    call.seed = pq_copy_ruby_string(seed, &seed_len);
    call.seed_len = seed_len;

    rb_thread_call_without_gvl(pq_testing_sign_nogvl, &call, NULL, NULL);

    pq_free_buffer(call.message);
    pq_wipe_and_free((uint8_t *)call.secret_key, secret_key_len);
    pq_wipe_and_free((uint8_t *)call.seed, call.seed_len);

    if (call.result != PQ_SUCCESS) {
        pq_free_buffer(call.signature);
        pq_raise_general_error(call.result);
    }

    VALUE result = pq_string_from_buffer(call.signature, call.signature_len);
    pq_free_buffer(call.signature);
    return result;
}

.__test_sign_keypair_from_seed(seed) ⇒ Object 



911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 911

static VALUE pqcrypto__test_sign_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    StringValue(seed);

    if ((size_t)RSTRING_LEN(seed) != 32) {
        rb_raise(rb_eArgError, "Deterministic test seed must be 32 bytes");
    }

    sign_keypair_call_t call = {0};
    size_t seed_len = 0;
    call.public_key = pq_alloc_buffer(PQ_MLDSA_PUBLICKEYBYTES);
    call.secret_key = pq_alloc_buffer(PQ_MLDSA_SECRETKEYBYTES);
    call.seed = pq_copy_ruby_string(seed, &seed_len);
    call.seed_len = seed_len;

    rb_thread_call_without_gvl(pq_testing_sign_keypair_nogvl, &call, NULL, NULL);
    pq_wipe_and_free((uint8_t *)call.seed, call.seed_len);

    if (call.result != PQ_SUCCESS) {
        pq_wipe_and_free(call.secret_key, PQ_MLDSA_SECRETKEYBYTES);
        free(call.public_key);
        pq_raise_general_error(call.result);
    }

    VALUE result = rb_ary_new2(2);
    rb_ary_push(result, pq_string_from_buffer(call.public_key, PQ_MLDSA_PUBLICKEYBYTES));
    rb_ary_push(result, pq_string_from_buffer(call.secret_key, PQ_MLDSA_SECRETKEYBYTES));

    free(call.public_key);
    pq_wipe_and_free(call.secret_key, PQ_MLDSA_SECRETKEYBYTES);
    return result;
}

._native_mldsa_compute_tr(public_key) ⇒ Object 



1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1318

static VALUE pqcrypto__native_mldsa_compute_tr(VALUE self, VALUE public_key) {
    (void)self;
    pq_validate_bytes_argument(public_key, PQ_MLDSA_PUBLICKEYBYTES, "public key");

    uint8_t tr[PQ_MLDSA_TRBYTES];
    int rc = pq_mldsa_compute_tr_from_public_key(tr, (const uint8_t *)RSTRING_PTR(public_key));
    if (rc != PQ_SUCCESS) {
        pq_raise_general_error(rc);
    }
    return pq_string_from_buffer(tr, sizeof(tr));
}

._native_mldsa_extract_tr(secret_key) ⇒ Object 



1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1303

static VALUE pqcrypto__native_mldsa_extract_tr(VALUE self, VALUE secret_key) {
    (void)self;
    pq_validate_bytes_argument(secret_key, PQ_MLDSA_SECRETKEYBYTES, "secret key");

    uint8_t tr[PQ_MLDSA_TRBYTES];
    int rc = pq_mldsa_extract_tr_from_secret_key(tr, (const uint8_t *)RSTRING_PTR(secret_key));
    if (rc != PQ_SUCCESS) {
        pq_secure_wipe(tr, sizeof(tr));
        pq_raise_general_error(rc);
    }
    VALUE result = pq_string_from_buffer(tr, sizeof(tr));
    pq_secure_wipe(tr, sizeof(tr));
    return result;
}

._native_mldsa_mu_builder_finalize(builder_obj) ⇒ Object 



1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1398

static VALUE pqcrypto__native_mldsa_mu_builder_finalize(VALUE self, VALUE builder_obj) {
    (void)self;
    mu_builder_wrapper_t *wrapper = mu_builder_unwrap(builder_obj);

    uint8_t mu[PQ_MLDSA_MUBYTES];

    mu_finalize_call_t call = {0};
    call.builder = wrapper->builder;
    call.mu_out = mu;

    rb_nogvl(pq_mu_finalize_nogvl, &call, NULL, NULL, RB_NOGVL_OFFLOAD_SAFE);

    if (call.result != PQ_SUCCESS) {
        pq_mu_builder_release(wrapper->builder);
    }
    wrapper->builder = NULL;

    if (call.result != PQ_SUCCESS) {
        pq_secure_wipe(mu, sizeof(mu));
        pq_raise_general_error(call.result);
    }

    VALUE result = pq_string_from_buffer(mu, sizeof(mu));
    pq_secure_wipe(mu, sizeof(mu));
    return result;
}

._native_mldsa_mu_builder_new(tr, ctx) ⇒ Object 



1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1330

static VALUE pqcrypto__native_mldsa_mu_builder_new(VALUE self, VALUE tr, VALUE ctx) {
    (void)self;
    pq_validate_bytes_argument(tr, PQ_MLDSA_TRBYTES, "tr");
    StringValue(ctx);

    size_t ctxlen = (size_t)RSTRING_LEN(ctx);
    if (ctxlen > 255) {
        rb_raise(rb_eArgError, "ML-DSA context length must be <= 255 bytes");
    }

    void *builder = pq_mu_builder_new();
    if (builder == NULL) {
        rb_raise(rb_eNoMemError, "Memory allocation failed (mu builder)");
    }

    int rc = pq_mu_builder_init(builder, (const uint8_t *)RSTRING_PTR(tr),
                                (const uint8_t *)RSTRING_PTR(ctx), ctxlen);
    if (rc != PQ_SUCCESS) {
        pq_mu_builder_release(builder);
        pq_raise_general_error(rc);
    }

    mu_builder_wrapper_t *wrapper;
    VALUE obj =
        TypedData_Make_Struct(rb_cObject, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
    wrapper->builder = builder;
    return obj;
}

._native_mldsa_mu_builder_release(builder_obj) ⇒ Object 



1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1425

static VALUE pqcrypto__native_mldsa_mu_builder_release(VALUE self, VALUE builder_obj) {
    (void)self;
    mu_builder_wrapper_t *wrapper;
    TypedData_Get_Struct(builder_obj, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
    if (wrapper != NULL && wrapper->builder != NULL) {
        pq_mu_builder_release(wrapper->builder);
        wrapper->builder = NULL;
    }
    return Qnil;
}

._native_mldsa_mu_builder_update(builder_obj, chunk) ⇒ Object 



1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1365

static VALUE pqcrypto__native_mldsa_mu_builder_update(VALUE self, VALUE builder_obj, VALUE chunk) {
    (void)self;
    mu_builder_wrapper_t *wrapper = mu_builder_unwrap(builder_obj);
    StringValue(chunk);

    size_t chunk_len = (size_t)RSTRING_LEN(chunk);
    if (chunk_len == 0) {
        return Qnil;
    }

    uint8_t *copy = pq_alloc_buffer(chunk_len);
    memcpy(copy, RSTRING_PTR(chunk), chunk_len);

    mu_absorb_call_t call = {0};
    call.builder = wrapper->builder;
    call.chunk = copy;
    call.chunk_len = chunk_len;

    rb_nogvl(pq_mu_absorb_nogvl, &call, NULL, NULL, RB_NOGVL_OFFLOAD_SAFE);
    free(copy);

    if (call.result != PQ_SUCCESS) {
        pq_raise_general_error(call.result);
    }
    return Qnil;
}

._native_mldsa_sign_mu(mu, secret_key) ⇒ Object 



1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1442

static VALUE pqcrypto__native_mldsa_sign_mu(VALUE self, VALUE mu, VALUE secret_key) {
    (void)self;
    pq_validate_bytes_argument(mu, PQ_MLDSA_MUBYTES, "mu");
    pq_validate_bytes_argument(secret_key, PQ_MLDSA_SECRETKEYBYTES, "secret key");

    sign_mu_call_t call = {0};
    size_t secret_key_len = 0;
    size_t mu_len = 0;
    uint8_t *mu_copy = pq_copy_ruby_string(mu, &mu_len);
    uint8_t *sk_copy = pq_copy_ruby_string(secret_key, &secret_key_len);

    call.mu = mu_copy;
    call.secret_key = sk_copy;
    call.signature_len = PQ_MLDSA_BYTES;
    call.signature = pq_alloc_buffer(PQ_MLDSA_BYTES);

    rb_nogvl(pq_sign_mu_nogvl, &call, NULL, NULL, RB_NOGVL_OFFLOAD_SAFE);

    pq_wipe_and_free(mu_copy, mu_len);
    pq_wipe_and_free(sk_copy, secret_key_len);

    if (call.result != PQ_SUCCESS) {
        pq_free_buffer(call.signature);
        pq_raise_general_error(call.result);
    }

    VALUE result = pq_string_from_buffer(call.signature, call.signature_len);
    pq_free_buffer(call.signature);
    return result;
}

._native_mldsa_verify_mu(mu, signature, public_key) ⇒ Object 



1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1479

static VALUE pqcrypto__native_mldsa_verify_mu(VALUE self, VALUE mu, VALUE signature,
                                              VALUE public_key) {
    (void)self;
    StringValue(signature);
    pq_validate_bytes_argument(mu, PQ_MLDSA_MUBYTES, "mu");
    pq_validate_bytes_argument(public_key, PQ_MLDSA_PUBLICKEYBYTES, "public key");

    verify_mu_call_t call = {0};
    size_t public_key_len = 0;
    size_t signature_len = 0;
    size_t mu_len = 0;
    uint8_t *mu_copy = pq_copy_ruby_string(mu, &mu_len);
    uint8_t *pk_copy = pq_copy_ruby_string(public_key, &public_key_len);
    uint8_t *sig_copy = pq_copy_ruby_string(signature, &signature_len);

    call.mu = mu_copy;
    call.public_key = pk_copy;
    call.signature = sig_copy;
    call.signature_len = signature_len;

    rb_nogvl(pq_verify_mu_nogvl, &call, NULL, NULL, RB_NOGVL_OFFLOAD_SAFE);
    pq_wipe_and_free(mu_copy, mu_len);
    pq_free_buffer(pk_copy);
    pq_free_buffer(sig_copy);

    if (call.result == PQ_SUCCESS) {
        return Qtrue;
    }
    if (call.result == PQ_ERROR_VERIFY) {
        return Qfalse;
    }
    pq_raise_general_error(call.result);
}

.backend ⇒ Object 



131
132
133
 
# File 'lib/pq_crypto.rb', line 131

def backend
  :native_pqclean
end

.ct_equals(a, b) ⇒ Object 



1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1200

static VALUE pqcrypto_ct_equals(VALUE self, VALUE a, VALUE b) {
    (void)self;
    StringValue(a);
    StringValue(b);
    if (RSTRING_LEN(a) != RSTRING_LEN(b)) {
        return Qfalse;
    }
    if (RSTRING_LEN(a) == 0) {
        return Qtrue;
    }
    if (CRYPTO_memcmp(RSTRING_PTR(a), RSTRING_PTR(b), (size_t)RSTRING_LEN(a)) == 0) {
        return Qtrue;
    }
    return Qfalse;
}

.hybrid_kem_decapsulate(ciphertext, secret_key) ⇒ Object 



779
780
781
782
783
784
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 779

static VALUE pqcrypto_hybrid_kem_decapsulate(VALUE self, VALUE ciphertext, VALUE secret_key) {
    (void)self;
    return pq_run_kem_decapsulate(pq_hybrid_kem_decapsulate_nogvl, ciphertext,
                                  PQ_HYBRID_CIPHERTEXTBYTES, secret_key, PQ_HYBRID_SECRETKEYBYTES,
                                  PQ_HYBRID_SHAREDSECRETBYTES);
}

.hybrid_kem_encapsulate(public_key) ⇒ Object 



772
773
774
775
776
777
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 772

static VALUE pqcrypto_hybrid_kem_encapsulate(VALUE self, VALUE public_key) {
    (void)self;
    return pq_run_kem_encapsulate(pq_hybrid_kem_encapsulate_nogvl, public_key,
                                  PQ_HYBRID_PUBLICKEYBYTES, PQ_HYBRID_CIPHERTEXTBYTES,
                                  PQ_HYBRID_SHAREDSECRETBYTES);
}

.hybrid_kem_keypair ⇒ Object 



766
767
768
769
770
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 766

static VALUE pqcrypto_hybrid_kem_keypair(VALUE self) {
    (void)self;
    return pq_run_kem_keypair(pq_hybrid_kem_keypair_nogvl, PQ_HYBRID_PUBLICKEYBYTES,
                              PQ_HYBRID_SECRETKEYBYTES);
}

.ml_dsa_44_keypair ⇒ Object 



1098
1099
1100
1101
1102
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1098

static VALUE pqcrypto_ml_dsa_44_keypair(VALUE self) {
    (void)self;
    return pq_run_sign_keypair(pq_mldsa_44_sign_keypair_nogvl, MLDSA44_PUBLICKEYBYTES,
                               MLDSA44_SECRETKEYBYTES);
}

.ml_dsa_44_keypair_from_seed(seed) ⇒ Object 



1025
1026
1027
1028
1029
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1025

static VALUE pqcrypto_ml_dsa_44_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    return pq_run_test_sign_keypair_from_seed(pq_mldsa_44_keypair_from_seed_nogvl, seed,
                                              MLDSA44_PUBLICKEYBYTES, MLDSA44_SECRETKEYBYTES);
}

.ml_dsa_44_sign(message, secret_key) ⇒ Object 



1141
1142
1143
1144
1145
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1141

static VALUE pqcrypto_ml_dsa_44_sign(VALUE self, VALUE message, VALUE secret_key) {
    (void)self;
    return pq_run_sign(pq_mldsa_44_sign_nogvl, message, secret_key, MLDSA44_SECRETKEYBYTES,
                       MLDSA44_BYTES);
}

.ml_dsa_44_verify(message, signature, public_key) ⇒ Object 



1186
1187
1188
1189
1190
1191
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1186

static VALUE pqcrypto_ml_dsa_44_verify(VALUE self, VALUE message, VALUE signature,
                                       VALUE public_key) {
    (void)self;
    return pq_run_verify(pq_mldsa_44_verify_nogvl, message, signature, public_key,
                         MLDSA44_PUBLICKEYBYTES);
}

.ml_dsa_87_keypair ⇒ Object 



1104
1105
1106
1107
1108
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1104

static VALUE pqcrypto_ml_dsa_87_keypair(VALUE self) {
    (void)self;
    return pq_run_sign_keypair(pq_mldsa_87_sign_keypair_nogvl, MLDSA87_PUBLICKEYBYTES,
                               MLDSA87_SECRETKEYBYTES);
}

.ml_dsa_87_keypair_from_seed(seed) ⇒ Object 



1037
1038
1039
1040
1041
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1037

static VALUE pqcrypto_ml_dsa_87_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    return pq_run_test_sign_keypair_from_seed(pq_mldsa_87_keypair_from_seed_nogvl, seed,
                                              MLDSA87_PUBLICKEYBYTES, MLDSA87_SECRETKEYBYTES);
}

.ml_dsa_87_sign(message, secret_key) ⇒ Object 



1147
1148
1149
1150
1151
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1147

static VALUE pqcrypto_ml_dsa_87_sign(VALUE self, VALUE message, VALUE secret_key) {
    (void)self;
    return pq_run_sign(pq_mldsa_87_sign_nogvl, message, secret_key, MLDSA87_SECRETKEYBYTES,
                       MLDSA87_BYTES);
}

.ml_dsa_87_verify(message, signature, public_key) ⇒ Object 



1193
1194
1195
1196
1197
1198
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1193

static VALUE pqcrypto_ml_dsa_87_verify(VALUE self, VALUE message, VALUE signature,
                                       VALUE public_key) {
    (void)self;
    return pq_run_verify(pq_mldsa_87_verify_nogvl, message, signature, public_key,
                         MLDSA87_PUBLICKEYBYTES);
}

.ml_dsa_keypair_from_seed(seed) ⇒ Object 



1031
1032
1033
1034
1035
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1031

static VALUE pqcrypto_ml_dsa_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    return pq_run_test_sign_keypair_from_seed(pq_mldsa_keypair_from_seed_nogvl, seed,
                                              PQ_MLDSA_PUBLICKEYBYTES, PQ_MLDSA_SECRETKEYBYTES);
}

.ml_kem_1024_decapsulate(ciphertext, secret_key) ⇒ Object 



759
760
761
762
763
764
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 759

static VALUE pqcrypto_ml_kem_1024_decapsulate(VALUE self, VALUE ciphertext, VALUE secret_key) {
    (void)self;
    return pq_run_kem_decapsulate(pq_ml_kem_1024_decapsulate_nogvl, ciphertext,
                                  MLKEM1024_CIPHERTEXTBYTES, secret_key, MLKEM1024_SECRETKEYBYTES,
                                  MLKEM1024_SHAREDSECRETBYTES);
}

.ml_kem_1024_encapsulate(public_key) ⇒ Object 



752
753
754
755
756
757
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 752

static VALUE pqcrypto_ml_kem_1024_encapsulate(VALUE self, VALUE public_key) {
    (void)self;
    return pq_run_kem_encapsulate(pq_ml_kem_1024_encapsulate_nogvl, public_key,
                                  MLKEM1024_PUBLICKEYBYTES, MLKEM1024_CIPHERTEXTBYTES,
                                  MLKEM1024_SHAREDSECRETBYTES);
}

.ml_kem_1024_keypair ⇒ Object 



740
741
742
743
744
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 740

static VALUE pqcrypto_ml_kem_1024_keypair(VALUE self) {
    (void)self;
    return pq_run_kem_keypair(pq_ml_kem_1024_keypair_nogvl, MLKEM1024_PUBLICKEYBYTES,
                              MLKEM1024_SECRETKEYBYTES);
}

.ml_kem_1024_keypair_from_seed(seed) ⇒ Object 



746
747
748
749
750
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 746

static VALUE pqcrypto_ml_kem_1024_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    return pq_run_kem_keypair_from_seed(pq_ml_kem_1024_keypair_from_seed_nogvl, seed,
                                        MLKEM1024_PUBLICKEYBYTES, MLKEM1024_SECRETKEYBYTES);
}

.ml_kem_512_decapsulate(ciphertext, secret_key) ⇒ Object 



733
734
735
736
737
738
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 733

static VALUE pqcrypto_ml_kem_512_decapsulate(VALUE self, VALUE ciphertext, VALUE secret_key) {
    (void)self;
    return pq_run_kem_decapsulate(pq_ml_kem_512_decapsulate_nogvl, ciphertext,
                                  MLKEM512_CIPHERTEXTBYTES, secret_key, MLKEM512_SECRETKEYBYTES,
                                  MLKEM512_SHAREDSECRETBYTES);
}

.ml_kem_512_encapsulate(public_key) ⇒ Object 



726
727
728
729
730
731
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 726

static VALUE pqcrypto_ml_kem_512_encapsulate(VALUE self, VALUE public_key) {
    (void)self;
    return pq_run_kem_encapsulate(pq_ml_kem_512_encapsulate_nogvl, public_key,
                                  MLKEM512_PUBLICKEYBYTES, MLKEM512_CIPHERTEXTBYTES,
                                  MLKEM512_SHAREDSECRETBYTES);
}

.ml_kem_512_keypair ⇒ Object 



714
715
716
717
718
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 714

static VALUE pqcrypto_ml_kem_512_keypair(VALUE self) {
    (void)self;
    return pq_run_kem_keypair(pq_ml_kem_512_keypair_nogvl, MLKEM512_PUBLICKEYBYTES,
                              MLKEM512_SECRETKEYBYTES);
}

.ml_kem_512_keypair_from_seed(seed) ⇒ Object 



720
721
722
723
724
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 720

static VALUE pqcrypto_ml_kem_512_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    return pq_run_kem_keypair_from_seed(pq_ml_kem_512_keypair_from_seed_nogvl, seed,
                                        MLKEM512_PUBLICKEYBYTES, MLKEM512_SECRETKEYBYTES);
}

.ml_kem_decapsulate(ciphertext, secret_key) ⇒ Object 



708
709
710
711
712
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 708

static VALUE pqcrypto_ml_kem_decapsulate(VALUE self, VALUE ciphertext, VALUE secret_key) {
    (void)self;
    return pq_run_kem_decapsulate(pq_ml_kem_decapsulate_nogvl, ciphertext, PQ_MLKEM_CIPHERTEXTBYTES,
                                  secret_key, PQ_MLKEM_SECRETKEYBYTES, PQ_MLKEM_SHAREDSECRETBYTES);
}

.ml_kem_encapsulate(public_key) ⇒ Object 



702
703
704
705
706
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 702

static VALUE pqcrypto_ml_kem_encapsulate(VALUE self, VALUE public_key) {
    (void)self;
    return pq_run_kem_encapsulate(pq_ml_kem_encapsulate_nogvl, public_key, PQ_MLKEM_PUBLICKEYBYTES,
                                  PQ_MLKEM_CIPHERTEXTBYTES, PQ_MLKEM_SHAREDSECRETBYTES);
}

.ml_kem_keypair ⇒ Object 



630
631
632
633
634
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 630

static VALUE pqcrypto_ml_kem_keypair(VALUE self) {
    (void)self;
    return pq_run_kem_keypair(pq_ml_kem_keypair_nogvl, PQ_MLKEM_PUBLICKEYBYTES,
                              PQ_MLKEM_SECRETKEYBYTES);
}

.ml_kem_keypair_from_seed(seed) ⇒ Object 



669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 669

static VALUE pqcrypto_ml_kem_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    StringValue(seed);

    if ((size_t)RSTRING_LEN(seed) != 64) {
        rb_raise(rb_eArgError, "ML-KEM seed must be 64 bytes (FIPS 203 d||z)");
    }

    kem_keypair_call_t call = {0};
    size_t seed_len = 0;
    call.public_key = pq_alloc_buffer(PQ_MLKEM_PUBLICKEYBYTES);
    call.secret_key = pq_alloc_buffer(PQ_MLKEM_SECRETKEYBYTES);
    call.seed = pq_copy_ruby_string(seed, &seed_len);
    call.seed_len = seed_len;

    rb_thread_call_without_gvl(pq_ml_kem_keypair_from_seed_nogvl, &call, NULL, NULL);
    pq_wipe_and_free((uint8_t *)call.seed, call.seed_len);

    if (call.result != PQ_SUCCESS) {
        pq_wipe_and_free(call.secret_key, PQ_MLKEM_SECRETKEYBYTES);
        free(call.public_key);
        pq_raise_general_error(call.result);
    }

    VALUE result = rb_ary_new2(2);
    rb_ary_push(result, pq_string_from_buffer(call.public_key, PQ_MLKEM_PUBLICKEYBYTES));
    rb_ary_push(result, pq_string_from_buffer(call.secret_key, PQ_MLKEM_SECRETKEYBYTES));

    free(call.public_key);
    pq_wipe_and_free(call.secret_key, PQ_MLKEM_SECRETKEYBYTES);
    return result;
}

.native_extension_loaded? ⇒ Boolean

Returns:

  • (Boolean) 


135
136
137
 
# File 'lib/pq_crypto.rb', line 135

def native_extension_loaded?
  true
end

.public_key_from_pqc_container_der(der) ⇒ Object 



1568
1569
1570
1571
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1568

static VALUE pqcrypto_public_key_from_pqc_container_der(VALUE self, VALUE der) {
    (void)self;
    return pq_import_container_der(der, pq_public_key_from_pqc_container_der);
}

.public_key_from_pqc_container_pem(pem) ⇒ Object 



1573
1574
1575
1576
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1573

static VALUE pqcrypto_public_key_from_pqc_container_pem(VALUE self, VALUE pem) {
    (void)self;
    return pq_import_container_pem(pem, pq_public_key_from_pqc_container_pem);
}

.public_key_to_pqc_container_der(algorithm, key_bytes) ⇒ Object 



1544
1545
1546
1547
1548
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1544

static VALUE pqcrypto_public_key_to_pqc_container_der(VALUE self, VALUE algorithm,
                                                      VALUE key_bytes) {
    (void)self;
    return pq_export_container_der(algorithm, key_bytes, pq_public_key_to_pqc_container_der);
}

.public_key_to_pqc_container_pem(algorithm, key_bytes) ⇒ Object 



1550
1551
1552
1553
1554
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1550

static VALUE pqcrypto_public_key_to_pqc_container_pem(VALUE self, VALUE algorithm,
                                                      VALUE key_bytes) {
    (void)self;
    return pq_export_container_pem(algorithm, key_bytes, pq_public_key_to_pqc_container_pem);
}

.secret_key_from_pqc_container_der(der) ⇒ Object 



1578
1579
1580
1581
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1578

static VALUE pqcrypto_secret_key_from_pqc_container_der(VALUE self, VALUE der) {
    (void)self;
    return pq_import_container_der(der, pq_secret_key_from_pqc_container_der);
}

.secret_key_from_pqc_container_pem(pem) ⇒ Object 



1583
1584
1585
1586
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1583

static VALUE pqcrypto_secret_key_from_pqc_container_pem(VALUE self, VALUE pem) {
    (void)self;
    return pq_import_container_pem(pem, pq_secret_key_from_pqc_container_pem);
}

.secret_key_to_pqc_container_der(algorithm, key_bytes) ⇒ Object 



1556
1557
1558
1559
1560
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1556

static VALUE pqcrypto_secret_key_to_pqc_container_der(VALUE self, VALUE algorithm,
                                                      VALUE key_bytes) {
    (void)self;
    return pq_export_container_der(algorithm, key_bytes, pq_secret_key_to_pqc_container_der);
}

.secret_key_to_pqc_container_pem(algorithm, key_bytes) ⇒ Object 



1562
1563
1564
1565
1566
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1562

static VALUE pqcrypto_secret_key_to_pqc_container_pem(VALUE self, VALUE algorithm,
                                                      VALUE key_bytes) {
    (void)self;
    return pq_export_container_pem(algorithm, key_bytes, pq_secret_key_to_pqc_container_pem);
}

.secure_wipe(str) ⇒ Object

Raises:

  • (ArgumentError) 


1216
1217
1218
1219
1220
1221
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1216

def secure_wipe(string)
  string = String(string)
  raise ArgumentError, "secure_wipe requires a mutable String" if string.frozen?

  native_secure_wipe(string)
end

.sign(message, secret_key) ⇒ Object 



1136
1137
1138
1139
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1136

static VALUE pqcrypto_sign(VALUE self, VALUE message, VALUE secret_key) {
    (void)self;
    return pq_run_sign(pq_sign_nogvl, message, secret_key, PQ_MLDSA_SECRETKEYBYTES, PQ_MLDSA_BYTES);
}

.sign_keypair ⇒ Object 



1092
1093
1094
1095
1096
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1092

static VALUE pqcrypto_sign_keypair(VALUE self) {
    (void)self;
    return pq_run_sign_keypair(pq_sign_keypair_nogvl, PQ_MLDSA_PUBLICKEYBYTES,
                               PQ_MLDSA_SECRETKEYBYTES);
}

.supported_hybrid_kems ⇒ Object 



143
144
145
 
# File 'lib/pq_crypto.rb', line 143

def supported_hybrid_kems
  SUITES.fetch(:hybrid_kem).dup
end

.supported_kems ⇒ Object 



139
140
141
 
# File 'lib/pq_crypto.rb', line 139

def supported_kems
  SUITES.fetch(:kem).dup
end

.supported_signatures ⇒ Object 



147
148
149
 
# File 'lib/pq_crypto.rb', line 147

def supported_signatures
  SUITES.fetch(:signature).dup
end

.verify(message, signature, public_key) ⇒ Object 



1181
1182
1183
1184
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1181

static VALUE pqcrypto_verify(VALUE self, VALUE message, VALUE signature, VALUE public_key) {
    (void)self;
    return pq_run_verify(pq_verify_nogvl, message, signature, public_key, PQ_MLDSA_PUBLICKEYBYTES);
}

.version ⇒ Object 



1224
1225
1226
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1224

def version
  native_version
end