Module: PQCrypto

Defined in:
lib/pq_crypto.rb,
lib/pq_crypto/kem.rb,
lib/pq_crypto/spki.rb,
lib/pq_crypto/pkcs8.rb,
lib/pq_crypto/errors.rb,
lib/pq_crypto/version.rb,
lib/pq_crypto/signature.rb,
lib/pq_crypto/hybrid_kem.rb,
lib/pq_crypto/serialization.rb,
lib/pq_crypto/algorithm_registry.rb,
ext/pqcrypto/pqcrypto_ruby_secure.c

Defined Under Namespace

Modules: AlgorithmRegistry, HybridKEM, KEM, NativeBindings, PKCS8, SPKI, Serialization, Signature, Testing Classes: Error, InvalidCiphertextError, InvalidKeyError, SerializationError, UnsupportedAlgorithmError, VerificationError

Constant Summary collapse

SUITES = 
{
  kem: AlgorithmRegistry.supported_kems,
  hybrid_kem: AlgorithmRegistry.supported_hybrid_kems,
  signature: AlgorithmRegistry.supported_signatures,
}.freeze
NATIVE_EXTENSION_LOADED = 
true
VERSION = 
"0.5.3"
ML_KEM_512_PUBLIC_KEY_BYTES = 
INT2NUM(MLKEM512_PUBLICKEYBYTES)
ML_KEM_512_SECRET_KEY_BYTES = 
INT2NUM(MLKEM512_SECRETKEYBYTES)
ML_KEM_512_CIPHERTEXT_BYTES = 
INT2NUM(MLKEM512_CIPHERTEXTBYTES)
ML_KEM_512_SHARED_SECRET_BYTES = 
INT2NUM(MLKEM512_SHAREDSECRETBYTES)
ML_KEM_PUBLIC_KEY_BYTES = 
INT2NUM(PQ_MLKEM_PUBLICKEYBYTES)
ML_KEM_SECRET_KEY_BYTES = 
INT2NUM(PQ_MLKEM_SECRETKEYBYTES)
ML_KEM_CIPHERTEXT_BYTES = 
INT2NUM(PQ_MLKEM_CIPHERTEXTBYTES)
ML_KEM_SHARED_SECRET_BYTES = 
INT2NUM(PQ_MLKEM_SHAREDSECRETBYTES)
ML_KEM_1024_PUBLIC_KEY_BYTES = 
INT2NUM(MLKEM1024_PUBLICKEYBYTES)
ML_KEM_1024_SECRET_KEY_BYTES = 
INT2NUM(MLKEM1024_SECRETKEYBYTES)
ML_KEM_1024_CIPHERTEXT_BYTES = 
INT2NUM(MLKEM1024_CIPHERTEXTBYTES)
ML_KEM_1024_SHARED_SECRET_BYTES = 
INT2NUM(MLKEM1024_SHAREDSECRETBYTES)
HYBRID_KEM_PUBLIC_KEY_BYTES = 
INT2NUM(PQ_HYBRID_PUBLICKEYBYTES)
HYBRID_KEM_SECRET_KEY_BYTES = 
INT2NUM(PQ_HYBRID_SECRETKEYBYTES)
HYBRID_KEM_CIPHERTEXT_BYTES = 
INT2NUM(PQ_HYBRID_CIPHERTEXTBYTES)
HYBRID_KEM_SHARED_SECRET_BYTES = 
INT2NUM(PQ_HYBRID_SHAREDSECRETBYTES)
SIGN_44_PUBLIC_KEY_BYTES = 
INT2NUM(MLDSA44_PUBLICKEYBYTES)
SIGN_44_SECRET_KEY_BYTES = 
INT2NUM(MLDSA44_SECRETKEYBYTES)
SIGN_44_BYTES = 
INT2NUM(MLDSA44_BYTES)
SIGN_PUBLIC_KEY_BYTES = 
INT2NUM(PQ_MLDSA_PUBLICKEYBYTES)
SIGN_SECRET_KEY_BYTES = 
INT2NUM(PQ_MLDSA_SECRETKEYBYTES)
SIGN_BYTES = 
INT2NUM(PQ_MLDSA_BYTES)
SIGN_87_PUBLIC_KEY_BYTES = 
INT2NUM(MLDSA87_PUBLICKEYBYTES)
SIGN_87_SECRET_KEY_BYTES = 
INT2NUM(MLDSA87_SECRETKEYBYTES)
SIGN_87_BYTES = 
INT2NUM(MLDSA87_BYTES)

Class Method Summary collapse

Class Method Details

.__test_ml_dsa_44_keypair_from_seed(seed) ⇒ Object 



1092
1093
1094
1095
1096
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1092

static VALUE pqcrypto__test_ml_dsa_44_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    return pq_run_test_sign_keypair_from_seed(pq_testing_mldsa_44_keypair_nogvl, seed,
                                              MLDSA44_PUBLICKEYBYTES, MLDSA44_SECRETKEYBYTES);
}

.__test_ml_dsa_44_sign_from_seed(message, secret_key, seed) ⇒ Object 



1155
1156
1157
1158
1159
1160
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1155

static VALUE pqcrypto__test_ml_dsa_44_sign_from_seed(VALUE self, VALUE message, VALUE secret_key,
                                                     VALUE seed) {
    (void)self;
    return pq_run_test_sign_from_seed(pq_testing_mldsa_44_sign_nogvl, message, secret_key, seed,
                                      MLDSA44_SECRETKEYBYTES, MLDSA44_BYTES);
}

.__test_ml_dsa_87_keypair_from_seed(seed) ⇒ Object 



1098
1099
1100
1101
1102
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1098

static VALUE pqcrypto__test_ml_dsa_87_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    return pq_run_test_sign_keypair_from_seed(pq_testing_mldsa_87_keypair_nogvl, seed,
                                              MLDSA87_PUBLICKEYBYTES, MLDSA87_SECRETKEYBYTES);
}

.__test_ml_dsa_87_sign_from_seed(message, secret_key, seed) ⇒ Object 



1162
1163
1164
1165
1166
1167
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1162

static VALUE pqcrypto__test_ml_dsa_87_sign_from_seed(VALUE self, VALUE message, VALUE secret_key,
                                                     VALUE seed) {
    (void)self;
    return pq_run_test_sign_from_seed(pq_testing_mldsa_87_sign_nogvl, message, secret_key, seed,
                                      MLDSA87_SECRETKEYBYTES, MLDSA87_BYTES);
}

.__test_ml_kem_1024_encapsulate_from_seed(public_key, seed) ⇒ Object 



982
983
984
985
986
987
988
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 982

static VALUE pqcrypto__test_ml_kem_1024_encapsulate_from_seed(VALUE self, VALUE public_key,
                                                              VALUE seed) {
    (void)self;
    return pq_run_test_kem_encapsulate_from_seed(
        pq_testing_ml_kem_1024_encapsulate_nogvl, public_key, seed, MLKEM1024_PUBLICKEYBYTES,
        MLKEM1024_CIPHERTEXTBYTES, MLKEM1024_SHAREDSECRETBYTES);
}

.__test_ml_kem_512_encapsulate_from_seed(public_key, seed) ⇒ Object 



974
975
976
977
978
979
980
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 974

static VALUE pqcrypto__test_ml_kem_512_encapsulate_from_seed(VALUE self, VALUE public_key,
                                                             VALUE seed) {
    (void)self;
    return pq_run_test_kem_encapsulate_from_seed(
        pq_testing_ml_kem_512_encapsulate_nogvl, public_key, seed, MLKEM512_PUBLICKEYBYTES,
        MLKEM512_CIPHERTEXTBYTES, MLKEM512_SHAREDSECRETBYTES);
}

.__test_ml_kem_encapsulate_from_seed(public_key, seed) ⇒ Object 



898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 898

static VALUE pqcrypto__test_ml_kem_encapsulate_from_seed(VALUE self, VALUE public_key, VALUE seed) {
    (void)self;
    pq_validate_bytes_argument(public_key, PQ_MLKEM_PUBLICKEYBYTES, "public key");
    StringValue(seed);

    if ((size_t)RSTRING_LEN(seed) != 32) {
        rb_raise(rb_eArgError, "Deterministic test seed must be 32 bytes");
    }

    kem_encapsulate_call_t call = {0};
    size_t public_key_len = 0;
    size_t seed_len = 0;
    call.public_key = pq_copy_ruby_string(public_key, &public_key_len);
    call.ciphertext = pq_alloc_buffer(PQ_MLKEM_CIPHERTEXTBYTES);
    call.shared_secret = pq_alloc_buffer(PQ_MLKEM_SHAREDSECRETBYTES);
    call.seed = pq_copy_ruby_string(seed, &seed_len);
    call.seed_len = seed_len;

    rb_thread_call_without_gvl(pq_testing_ml_kem_encapsulate_nogvl, &call, NULL, NULL);
    pq_wipe_and_free((uint8_t *)call.public_key, public_key_len);
    pq_wipe_and_free((uint8_t *)call.seed, call.seed_len);

    if (call.result != PQ_SUCCESS) {
        pq_wipe_and_free(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES);
        free(call.ciphertext);
        pq_raise_general_error(call.result);
    }

    VALUE result = rb_ary_new2(2);
    rb_ary_push(result, pq_string_from_buffer(call.ciphertext, PQ_MLKEM_CIPHERTEXTBYTES));
    rb_ary_push(result, pq_string_from_buffer(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES));

    free(call.ciphertext);
    pq_wipe_and_free(call.shared_secret, PQ_MLKEM_SHAREDSECRETBYTES);
    return result;
}

.__test_ml_kem_keypair_from_seed(seed) ⇒ Object 



865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 865

static VALUE pqcrypto__test_ml_kem_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    StringValue(seed);

    if ((size_t)RSTRING_LEN(seed) != 64) {
        rb_raise(rb_eArgError, "Deterministic ML-KEM test seed must be 64 bytes (FIPS 203 d||z)");
    }

    kem_keypair_call_t call = {0};
    size_t seed_len = 0;
    call.public_key = pq_alloc_buffer(PQ_MLKEM_PUBLICKEYBYTES);
    call.secret_key = pq_alloc_buffer(PQ_MLKEM_SECRETKEYBYTES);
    call.seed = pq_copy_ruby_string(seed, &seed_len);
    call.seed_len = seed_len;

    rb_thread_call_without_gvl(pq_testing_ml_kem_keypair_nogvl, &call, NULL, NULL);
    pq_wipe_and_free((uint8_t *)call.seed, call.seed_len);

    if (call.result != PQ_SUCCESS) {
        pq_wipe_and_free(call.secret_key, PQ_MLKEM_SECRETKEYBYTES);
        free(call.public_key);
        pq_raise_general_error(call.result);
    }

    VALUE result = rb_ary_new2(2);
    rb_ary_push(result, pq_string_from_buffer(call.public_key, PQ_MLKEM_PUBLICKEYBYTES));
    rb_ary_push(result, pq_string_from_buffer(call.secret_key, PQ_MLKEM_SECRETKEYBYTES));

    free(call.public_key);
    pq_wipe_and_free(call.secret_key, PQ_MLKEM_SECRETKEYBYTES);
    return result;
}

.__test_sign_from_seed(message, secret_key, seed) ⇒ Object 



1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1023

static VALUE pqcrypto__test_sign_from_seed(VALUE self, VALUE message, VALUE secret_key,
                                           VALUE seed) {
    (void)self;
    pq_validate_bytes_argument(secret_key, PQ_MLDSA_SECRETKEYBYTES, "secret key");
    StringValue(seed);

    if ((size_t)RSTRING_LEN(seed) != 32) {
        rb_raise(rb_eArgError, "Deterministic test seed must be 32 bytes");
    }

    sign_call_t call = {0};
    size_t secret_key_len = 0;
    size_t seed_len = 0;
    call.secret_key = pq_copy_ruby_string(secret_key, &secret_key_len);
    call.signature_len = PQ_MLDSA_BYTES;
    call.signature = pq_alloc_buffer(PQ_MLDSA_BYTES);
    call.message = pq_copy_ruby_string(message, &call.message_len);
    call.seed = pq_copy_ruby_string(seed, &seed_len);
    call.seed_len = seed_len;

    rb_thread_call_without_gvl(pq_testing_sign_nogvl, &call, NULL, NULL);

    pq_free_buffer(call.message);
    pq_wipe_and_free((uint8_t *)call.secret_key, secret_key_len);
    pq_wipe_and_free((uint8_t *)call.seed, call.seed_len);

    if (call.result != PQ_SUCCESS) {
        pq_free_buffer(call.signature);
        pq_raise_general_error(call.result);
    }

    VALUE result = pq_string_from_buffer(call.signature, call.signature_len);
    pq_free_buffer(call.signature);
    return result;
}

.__test_sign_keypair_from_seed(seed) ⇒ Object 



990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 990

static VALUE pqcrypto__test_sign_keypair_from_seed(VALUE self, VALUE seed) {
    (void)self;
    StringValue(seed);

    if ((size_t)RSTRING_LEN(seed) != 32) {
        rb_raise(rb_eArgError, "Deterministic test seed must be 32 bytes");
    }

    sign_keypair_call_t call = {0};
    size_t seed_len = 0;
    call.public_key = pq_alloc_buffer(PQ_MLDSA_PUBLICKEYBYTES);
    call.secret_key = pq_alloc_buffer(PQ_MLDSA_SECRETKEYBYTES);
    call.seed = pq_copy_ruby_string(seed, &seed_len);
    call.seed_len = seed_len;

    rb_thread_call_without_gvl(pq_testing_sign_keypair_nogvl, &call, NULL, NULL);
    pq_wipe_and_free((uint8_t *)call.seed, call.seed_len);

    if (call.result != PQ_SUCCESS) {
        pq_wipe_and_free(call.secret_key, PQ_MLDSA_SECRETKEYBYTES);
        free(call.public_key);
        pq_raise_general_error(call.result);
    }

    VALUE result = rb_ary_new2(2);
    rb_ary_push(result, pq_string_from_buffer(call.public_key, PQ_MLDSA_PUBLICKEYBYTES));
    rb_ary_push(result, pq_string_from_buffer(call.secret_key, PQ_MLDSA_SECRETKEYBYTES));

    free(call.public_key);
    pq_wipe_and_free(call.secret_key, PQ_MLDSA_SECRETKEYBYTES);
    return result;
}

._native_mldsa_compute_tr(public_key) ⇒ Object 



1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1381

static VALUE pqcrypto__native_mldsa_compute_tr(VALUE self, VALUE public_key) {
    (void)self;
    pq_validate_bytes_argument(public_key, PQ_MLDSA_PUBLICKEYBYTES, "public key");

    uint8_t tr[PQ_MLDSA_TRBYTES];
    int rc = pq_mldsa_compute_tr_from_public_key(tr, (const uint8_t *)RSTRING_PTR(public_key));
    if (rc != PQ_SUCCESS) {
        pq_raise_general_error(rc);
    }
    return pq_string_from_buffer(tr, sizeof(tr));
}

._native_mldsa_extract_tr(secret_key) ⇒ Object 



1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1366

static VALUE pqcrypto__native_mldsa_extract_tr(VALUE self, VALUE secret_key) {
    (void)self;
    pq_validate_bytes_argument(secret_key, PQ_MLDSA_SECRETKEYBYTES, "secret key");

    uint8_t tr[PQ_MLDSA_TRBYTES];
    int rc = pq_mldsa_extract_tr_from_secret_key(tr, (const uint8_t *)RSTRING_PTR(secret_key));
    if (rc != PQ_SUCCESS) {
        pq_secure_wipe(tr, sizeof(tr));
        pq_raise_general_error(rc);
    }
    VALUE result = pq_string_from_buffer(tr, sizeof(tr));
    pq_secure_wipe(tr, sizeof(tr));
    return result;
}

._native_mldsa_mu_builder_finalize(builder_obj) ⇒ Object 



1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1470

static VALUE pqcrypto__native_mldsa_mu_builder_finalize(VALUE self, VALUE builder_obj) {
    (void)self;
    mu_builder_wrapper_t *wrapper = mu_builder_unwrap(builder_obj);

    uint8_t mu[PQ_MLDSA_MUBYTES];

    mu_finalize_call_t call = {0};
    call.builder = wrapper->builder;
    call.mu_out = mu;

    rb_nogvl(pq_mu_finalize_nogvl, &call, NULL, NULL, PQ_RB_NOGVL_OFFLOAD_SAFE);

    wrapper->builder = NULL;

    if (call.result != PQ_SUCCESS) {
        pq_secure_wipe(mu, sizeof(mu));
        pq_raise_general_error(call.result);
    }

    VALUE result = pq_string_from_buffer(mu, sizeof(mu));
    pq_secure_wipe(mu, sizeof(mu));
    return result;
}

._native_mldsa_mu_builder_new(tr, ctx) ⇒ Object 



1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1393

static VALUE pqcrypto__native_mldsa_mu_builder_new(VALUE self, VALUE tr, VALUE ctx) {
    (void)self;
    pq_validate_bytes_argument(tr, PQ_MLDSA_TRBYTES, "tr");
    StringValue(ctx);

    size_t ctxlen = (size_t)RSTRING_LEN(ctx);
    if (ctxlen > 255) {
        rb_raise(rb_eArgError, "ML-DSA context length must be <= 255 bytes");
    }

    void *builder = pq_mu_builder_new();
    if (builder == NULL) {
        rb_raise(rb_eNoMemError, "Memory allocation failed (mu builder)");
    }

    int rc = pq_mu_builder_init(builder, (const uint8_t *)RSTRING_PTR(tr),
                                (const uint8_t *)RSTRING_PTR(ctx), ctxlen);
    if (rc != PQ_SUCCESS) {
        pq_mu_builder_release(builder);
        pq_raise_general_error(rc);
    }

    mu_builder_wrapper_t *wrapper;
    VALUE obj =
        TypedData_Make_Struct(rb_cObject, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
    wrapper->builder = builder;
    return obj;
}

._native_mldsa_mu_builder_release(builder_obj) ⇒ Object 



1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1494

static VALUE pqcrypto__native_mldsa_mu_builder_release(VALUE self, VALUE builder_obj) {
    (void)self;
    mu_builder_wrapper_t *wrapper;
    TypedData_Get_Struct(builder_obj, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
    if (wrapper != NULL && wrapper->builder != NULL) {
        pq_mu_builder_release(wrapper->builder);
        wrapper->builder = NULL;
    }
    return Qnil;
}

._native_mldsa_mu_builder_update(builder_obj, chunk) ⇒ Object 



1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1428

static VALUE pqcrypto__native_mldsa_mu_builder_update(VALUE self, VALUE builder_obj, VALUE chunk) {
    (void)self;
    mu_builder_wrapper_t *wrapper = mu_builder_unwrap(builder_obj);
    StringValue(chunk);

    size_t chunk_len = (size_t)RSTRING_LEN(chunk);
    if (chunk_len == 0) {
        return Qnil;
    }

    if (chunk_len < PQ_MU_ABSORB_NOGVL_MIN_BYTES) {
        int rc =
            pq_mu_builder_absorb(wrapper->builder, (const uint8_t *)RSTRING_PTR(chunk), chunk_len);
        if (rc != PQ_SUCCESS) {
            pq_raise_general_error(rc);
        }
        return Qnil;
    }

    uint8_t *copy = pq_alloc_buffer(chunk_len);
    memcpy(copy, RSTRING_PTR(chunk), chunk_len);

    mu_absorb_call_t call = {0};
    call.builder = wrapper->builder;
    call.chunk = copy;
    call.chunk_len = chunk_len;

    rb_nogvl(pq_mu_absorb_nogvl, &call, NULL, NULL, PQ_RB_NOGVL_OFFLOAD_SAFE);
    free(copy);

    if (call.result != PQ_SUCCESS) {
        pq_raise_general_error(call.result);
    }
    return Qnil;
}

._native_mldsa_sign_mu(mu, secret_key) ⇒ Object 



1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1511

static VALUE pqcrypto__native_mldsa_sign_mu(VALUE self, VALUE mu, VALUE secret_key) {
    (void)self;
    pq_validate_bytes_argument(mu, PQ_MLDSA_MUBYTES, "mu");
    pq_validate_bytes_argument(secret_key, PQ_MLDSA_SECRETKEYBYTES, "secret key");

    sign_mu_call_t call = {0};
    size_t secret_key_len = 0;
    size_t mu_len = 0;
    uint8_t *mu_copy = pq_copy_ruby_string(mu, &mu_len);
    uint8_t *sk_copy = pq_copy_ruby_string(secret_key, &secret_key_len);

    call.mu = mu_copy;
    call.secret_key = sk_copy;
    call.signature_len = PQ_MLDSA_BYTES;
    call.signature = pq_alloc_buffer(PQ_MLDSA_BYTES);

    rb_nogvl(pq_sign_mu_nogvl, &call, NULL, NULL, PQ_RB_NOGVL_OFFLOAD_SAFE);

    pq_wipe_and_free(mu_copy, mu_len);
    pq_wipe_and_free(sk_copy, secret_key_len);

    if (call.result != PQ_SUCCESS) {
        pq_free_buffer(call.signature);
        pq_raise_general_error(call.result);
    }

    VALUE result = pq_string_from_buffer(call.signature, call.signature_len);
    pq_free_buffer(call.signature);
    return result;
}

._native_mldsa_verify_mu(mu, signature, public_key) ⇒ Object 



1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1548

static VALUE pqcrypto__native_mldsa_verify_mu(VALUE self, VALUE mu, VALUE signature,
                                              VALUE public_key) {
    (void)self;
    StringValue(signature);
    pq_validate_bytes_argument(mu, PQ_MLDSA_MUBYTES, "mu");
    pq_validate_bytes_argument(public_key, PQ_MLDSA_PUBLICKEYBYTES, "public key");

    verify_mu_call_t call = {0};
    size_t public_key_len = 0;
    size_t signature_len = 0;
    size_t mu_len = 0;
    uint8_t *mu_copy = pq_copy_ruby_string(mu, &mu_len);
    uint8_t *pk_copy = pq_copy_ruby_string(public_key, &public_key_len);
    uint8_t *sig_copy = pq_copy_ruby_string(signature, &signature_len);

    call.mu = mu_copy;
    call.public_key = pk_copy;
    call.signature = sig_copy;
    call.signature_len = signature_len;

    rb_nogvl(pq_verify_mu_nogvl, &call, NULL, NULL, PQ_RB_NOGVL_OFFLOAD_SAFE);
    pq_wipe_and_free(mu_copy, mu_len);
    pq_free_buffer(pk_copy);
    pq_free_buffer(sig_copy);

    if (call.result == PQ_SUCCESS) {
        return Qtrue;
    }
    if (call.result == PQ_ERROR_VERIFY) {
        return Qfalse;
    }
    pq_raise_general_error(call.result);
}

.backend ⇒ Object 



135
136
137
 
# File 'lib/pq_crypto.rb', line 135

def backend
  :native_pq_code_package
end

.ct_equals ⇒ Object

.hybrid_kem_decapsulate(ciphertext, secret_key) ⇒ Object 



815
816
817
818
819
820
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 815

static VALUE pqcrypto_hybrid_kem_decapsulate(VALUE self, VALUE ciphertext, VALUE secret_key) {
    (void)self;
    return pq_run_kem_decapsulate(pq_hybrid_kem_decapsulate_nogvl, ciphertext,
                                  PQ_HYBRID_CIPHERTEXTBYTES, secret_key, PQ_HYBRID_SECRETKEYBYTES,
                                  PQ_HYBRID_SHAREDSECRETBYTES);
}

.hybrid_kem_decapsulate_expanded(ciphertext, expanded_secret_key) ⇒ Object 



822
823
824
825
826
827
828
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 822

static VALUE pqcrypto_hybrid_kem_decapsulate_expanded(VALUE self, VALUE ciphertext,
                                                      VALUE expanded_secret_key) {
    (void)self;
    return pq_run_kem_decapsulate(pq_hybrid_kem_decapsulate_expanded_nogvl, ciphertext,
                                  PQ_HYBRID_CIPHERTEXTBYTES, expanded_secret_key,
                                  PQ_HYBRID_EXPANDED_SECRETKEYBYTES, PQ_HYBRID_SHAREDSECRETBYTES);
}

.hybrid_kem_decapsulate_expanded_object(ciphertext, expanded_secret_key_obj) ⇒ Object 



830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 830

static VALUE pqcrypto_hybrid_kem_decapsulate_expanded_object(VALUE self, VALUE ciphertext,
                                                             VALUE expanded_secret_key_obj) {
    (void)self;
    hybrid_expanded_key_wrapper_t *wrapper = hybrid_expanded_key_unwrap(expanded_secret_key_obj);
    hybrid_decapsulate_expanded_pkey_call_t call = {0};
    VALUE result;
    size_t copied_ciphertext_len = 0;

    pq_validate_bytes_argument(ciphertext, PQ_HYBRID_CIPHERTEXTBYTES, "ciphertext");

    call.ciphertext = pq_copy_ruby_string(ciphertext, &copied_ciphertext_len);
    call.expanded_secret_key = wrapper->expanded_secret_key;
    call.shared_secret = pq_alloc_buffer(PQ_HYBRID_SHAREDSECRETBYTES);

    if (EVP_PKEY_up_ref(wrapper->x25519_private_pkey) != 1) {
        pq_wipe_and_free((uint8_t *)call.ciphertext, copied_ciphertext_len);
        pq_wipe_and_free(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES);
        pq_raise_general_error(PQ_ERROR_OPENSSL);
    }
    call.x25519_private_pkey = wrapper->x25519_private_pkey;

    rb_thread_call_without_gvl(pq_hybrid_kem_decapsulate_expanded_pkey_nogvl, &call, NULL, NULL);
    EVP_PKEY_free((EVP_PKEY *)call.x25519_private_pkey);
    pq_wipe_and_free((uint8_t *)call.ciphertext, copied_ciphertext_len);

    if (call.result != PQ_SUCCESS) {
        pq_wipe_and_free(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES);
        pq_raise_general_error(call.result);
    }

    result = pq_string_from_buffer(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES);
    pq_wipe_and_free(call.shared_secret, PQ_HYBRID_SHAREDSECRETBYTES);
    return result;
}

.hybrid_kem_encapsulate(public_key) ⇒ Object 



748
749
750
751
752
753
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 748

static VALUE pqcrypto_hybrid_kem_encapsulate(VALUE self, VALUE public_key) {
    (void)self;
    return pq_run_kem_encapsulate(pq_hybrid_kem_encapsulate_nogvl, public_key,
                                  PQ_HYBRID_PUBLICKEYBYTES, PQ_HYBRID_CIPHERTEXTBYTES,
                                  PQ_HYBRID_SHAREDSECRETBYTES);
}

.hybrid_kem_expand_secret_key(secret_key) ⇒ Object 



755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 755

static VALUE pqcrypto_hybrid_kem_expand_secret_key(VALUE self, VALUE secret_key) {
    (void)self;
    hybrid_expand_call_t call = {0};
    VALUE result;
    size_t copied_secret_key_len = 0;

    pq_validate_bytes_argument(secret_key, PQ_HYBRID_SECRETKEYBYTES, "hybrid secret key");

    call.secret_key = pq_copy_ruby_string(secret_key, &copied_secret_key_len);
    call.expanded_secret_key = pq_alloc_buffer(PQ_HYBRID_EXPANDED_SECRETKEYBYTES);

    rb_thread_call_without_gvl(pq_hybrid_kem_expand_secret_key_nogvl, &call, NULL, NULL);
    pq_wipe_and_free((uint8_t *)call.secret_key, copied_secret_key_len);

    if (call.result != PQ_SUCCESS) {
        pq_wipe_and_free(call.expanded_secret_key, PQ_HYBRID_EXPANDED_SECRETKEYBYTES);
        pq_raise_general_error(call.result);
    }

    result = pq_string_from_buffer(call.expanded_secret_key, PQ_HYBRID_EXPANDED_SECRETKEYBYTES);
    pq_wipe_and_free(call.expanded_secret_key, PQ_HYBRID_EXPANDED_SECRETKEYBYTES);
    return result;
}

.hybrid_kem_expand_secret_key_object(secret_key) ⇒ Object 



779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 779

static VALUE pqcrypto_hybrid_kem_expand_secret_key_object(VALUE self, VALUE secret_key) {
    (void)self;
    hybrid_expand_call_t call = {0};
    size_t copied_secret_key_len = 0;

    pq_validate_bytes_argument(secret_key, PQ_HYBRID_SECRETKEYBYTES, "hybrid secret key");

    hybrid_expanded_key_wrapper_t *wrapper;
    VALUE obj = TypedData_Make_Struct(rb_cObject, hybrid_expanded_key_wrapper_t,
                                      &hybrid_expanded_key_data_type, wrapper);
    memset(wrapper->expanded_secret_key, 0, sizeof(wrapper->expanded_secret_key));
    wrapper->x25519_private_pkey = NULL;

    call.secret_key = pq_copy_ruby_string(secret_key, &copied_secret_key_len);
    call.expanded_secret_key = wrapper->expanded_secret_key;

    rb_thread_call_without_gvl(pq_hybrid_kem_expand_secret_key_nogvl, &call, NULL, NULL);
    pq_wipe_and_free((uint8_t *)call.secret_key, copied_secret_key_len);

    if (call.result != PQ_SUCCESS) {
        pq_secure_wipe(wrapper->expanded_secret_key, sizeof(wrapper->expanded_secret_key));
        pq_raise_general_error(call.result);
    }

    const hybrid_expanded_secret_key_t *expanded =
        (const hybrid_expanded_secret_key_t *)wrapper->expanded_secret_key;
    wrapper->x25519_private_pkey = EVP_PKEY_new_raw_private_key(
        EVP_PKEY_X25519, NULL, expanded->x25519_sk, X25519_SECRETKEYBYTES);
    if (!wrapper->x25519_private_pkey) {
        pq_secure_wipe(wrapper->expanded_secret_key, sizeof(wrapper->expanded_secret_key));
        pq_raise_general_error(PQ_ERROR_OPENSSL);
    }

    return obj;
}

.hybrid_kem_keypair ⇒ Object

.ml_dsa_44_keypair ⇒ Object

.ml_dsa_44_keypair_from_seed ⇒ Object

.ml_dsa_44_sign ⇒ Object

.ml_dsa_44_verify ⇒ Object

.ml_dsa_87_keypair ⇒ Object

.ml_dsa_87_keypair_from_seed ⇒ Object

.ml_dsa_87_sign ⇒ Object

.ml_dsa_87_verify ⇒ Object

.ml_dsa_keypair_from_seed ⇒ Object

.ml_kem_1024_decapsulate ⇒ Object

.ml_kem_1024_encapsulate ⇒ Object

.ml_kem_1024_keypair ⇒ Object

.ml_kem_1024_keypair_from_seed ⇒ Object

.ml_kem_512_decapsulate ⇒ Object

.ml_kem_512_encapsulate ⇒ Object

.ml_kem_512_keypair ⇒ Object

.ml_kem_512_keypair_from_seed ⇒ Object

.ml_kem_decapsulate ⇒ Object

.ml_kem_encapsulate ⇒ Object

.ml_kem_keypair ⇒ Object

.ml_kem_keypair_from_seed ⇒ Object

.native_extension_loaded? ⇒ Boolean

Returns:

  • (Boolean) 


139
140
141
 
# File 'lib/pq_crypto.rb', line 139

def native_extension_loaded?
  true
end

.public_key_from_pqc_container_der(der) ⇒ Object 



1637
1638
1639
1640
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1637

static VALUE pqcrypto_public_key_from_pqc_container_der(VALUE self, VALUE der) {
    (void)self;
    return pq_import_container_der(der, pq_public_key_from_pqc_container_der);
}

.public_key_from_pqc_container_pem(pem) ⇒ Object 



1642
1643
1644
1645
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1642

static VALUE pqcrypto_public_key_from_pqc_container_pem(VALUE self, VALUE pem) {
    (void)self;
    return pq_import_container_pem(pem, pq_public_key_from_pqc_container_pem);
}

.public_key_to_pqc_container_der(algorithm, key_bytes) ⇒ Object 



1613
1614
1615
1616
1617
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1613

static VALUE pqcrypto_public_key_to_pqc_container_der(VALUE self, VALUE algorithm,
                                                      VALUE key_bytes) {
    (void)self;
    return pq_export_container_der(algorithm, key_bytes, pq_public_key_to_pqc_container_der);
}

.public_key_to_pqc_container_pem(algorithm, key_bytes) ⇒ Object 



1619
1620
1621
1622
1623
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1619

static VALUE pqcrypto_public_key_to_pqc_container_pem(VALUE self, VALUE algorithm,
                                                      VALUE key_bytes) {
    (void)self;
    return pq_export_container_pem(algorithm, key_bytes, pq_public_key_to_pqc_container_pem);
}

.secret_key_from_pqc_container_der(der) ⇒ Object 



1647
1648
1649
1650
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1647

static VALUE pqcrypto_secret_key_from_pqc_container_der(VALUE self, VALUE der) {
    (void)self;
    return pq_import_container_der(der, pq_secret_key_from_pqc_container_der);
}

.secret_key_from_pqc_container_pem(pem) ⇒ Object 



1652
1653
1654
1655
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1652

static VALUE pqcrypto_secret_key_from_pqc_container_pem(VALUE self, VALUE pem) {
    (void)self;
    return pq_import_container_pem(pem, pq_secret_key_from_pqc_container_pem);
}

.secret_key_to_pqc_container_der(algorithm, key_bytes) ⇒ Object 



1625
1626
1627
1628
1629
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1625

static VALUE pqcrypto_secret_key_to_pqc_container_der(VALUE self, VALUE algorithm,
                                                      VALUE key_bytes) {
    (void)self;
    return pq_export_container_der(algorithm, key_bytes, pq_secret_key_to_pqc_container_der);
}

.secret_key_to_pqc_container_pem(algorithm, key_bytes) ⇒ Object 



1631
1632
1633
1634
1635
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1631

static VALUE pqcrypto_secret_key_to_pqc_container_pem(VALUE self, VALUE algorithm,
                                                      VALUE key_bytes) {
    (void)self;
    return pq_export_container_pem(algorithm, key_bytes, pq_secret_key_to_pqc_container_pem);
}

.secure_wipe(str) ⇒ Object

Raises:

  • (ArgumentError) 


1279
1280
1281
1282
1283
1284
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1279

def secure_wipe(string)
  string = String(string)
  raise ArgumentError, "secure_wipe requires a mutable String" if string.frozen?

  native_secure_wipe(string)
end

.sign ⇒ Object

.sign_keypair ⇒ Object

.supported_hybrid_kems ⇒ Object 



147
148
149
 
# File 'lib/pq_crypto.rb', line 147

def supported_hybrid_kems
  SUITES.fetch(:hybrid_kem).dup
end

.supported_kems ⇒ Object 



143
144
145
 
# File 'lib/pq_crypto.rb', line 143

def supported_kems
  SUITES.fetch(:kem).dup
end

.supported_signatures ⇒ Object 



151
152
153
 
# File 'lib/pq_crypto.rb', line 151

def supported_signatures
  SUITES.fetch(:signature).dup
end

.verify ⇒ Object

.version ⇒ Object 



1287
1288
1289
 
# File 'ext/pqcrypto/pqcrypto_ruby_secure.c', line 1287

def version
  native_version
end