Table of Contents

Interface IDsa

Namespace
CryptoHives.Foundation.Security.Cryptography.Dsa
Assembly
CryptoHives.Foundation.Security.Cryptography.dll

Defines a digital signature algorithm operating on caller-provided key material.

public interface IDsa : IDisposable
Inherited Members

Remarks

This is the low-level, stateless interface: keys are raw byte spans owned by the caller and never retained by the implementation. For a key-holding API that mirrors the .NET 10 built-in types, see MLDsa.

Implemented algorithms:

  • ML-DSA-44 (FIPS 204, security category 2)
  • ML-DSA-65 (FIPS 204, security category 3)
  • ML-DSA-87 (FIPS 204, security category 5)

Properties

AlgorithmName

Gets the algorithm name.

string AlgorithmName { get; }

Property Value

string

PublicKeySizeBytes

Gets the public key size in bytes.

int PublicKeySizeBytes { get; }

Property Value

int

SecretKeySizeBytes

Gets the secret key size in bytes.

int SecretKeySizeBytes { get; }

Property Value

int

SignatureSizeBytes

Gets the signature size in bytes.

int SignatureSizeBytes { get; }

Property Value

int

Methods

GenerateKeyPair(ReadOnlySpan<byte>, Span<byte>, Span<byte>)

Generates a key pair deterministically from the provided 32-byte seed ξ.

void GenerateKeyPair(ReadOnlySpan<byte> seed, Span<byte> publicKey, Span<byte> secretKey)

Parameters

seed ReadOnlySpan<byte>

The 32-byte key generation seed.

publicKey Span<byte>

The buffer to receive the public key.

secretKey Span<byte>

The buffer to receive the secret key.

Exceptions

ArgumentException

A parameter has an invalid size.

GenerateKeyPair(ReadOnlySpan<byte>, Span<byte>, Span<byte>, bool)

Generates a key pair from a seed, optionally skipping the pairwise consistency test.

void GenerateKeyPair(ReadOnlySpan<byte> seed, Span<byte> publicKey, Span<byte> secretKey, bool pairwiseConsistencyTest)

Parameters

seed ReadOnlySpan<byte>

The 32-byte key generation seed ξ.

publicKey Span<byte>

The buffer to receive the public key.

secretKey Span<byte>

The buffer to receive the secret key.

pairwiseConsistencyTest bool

true to verify the generated key pair; false to skip it.

Exceptions

ArgumentException

A parameter has an invalid size.

GenerateKeyPair(Span<byte>, Span<byte>)

Generates a new key pair using the OS random number generator.

void GenerateKeyPair(Span<byte> publicKey, Span<byte> secretKey)

Parameters

publicKey Span<byte>

The buffer to receive the public key.

secretKey Span<byte>

The buffer to receive the secret key.

Exceptions

ArgumentException

A buffer is too small.

GenerateKeyPair(Span<byte>, Span<byte>, bool)

Generates a key pair, optionally skipping the pairwise consistency test.

void GenerateKeyPair(Span<byte> publicKey, Span<byte> secretKey, bool pairwiseConsistencyTest)

Parameters

publicKey Span<byte>

The buffer to receive the public key.

secretKey Span<byte>

The buffer to receive the secret key.

pairwiseConsistencyTest bool

true to verify the generated key pair with a sign/verify round trip; false to skip it. See the remarks on the signature type.

Exceptions

ArgumentException

A buffer is too small.

Sign(ReadOnlySpan<byte>, ReadOnlySpan<byte>, ReadOnlySpan<byte>, Span<byte>)

Signs a message using the hedged (randomized) variant of ML-DSA.

void Sign(ReadOnlySpan<byte> secretKey, ReadOnlySpan<byte> message, ReadOnlySpan<byte> context, Span<byte> signature)

Parameters

secretKey ReadOnlySpan<byte>

The secret key.

message ReadOnlySpan<byte>

The message to sign.

context ReadOnlySpan<byte>

The optional context string (at most 255 bytes).

signature Span<byte>

The buffer to receive the signature.

Exceptions

ArgumentException

A parameter has an invalid size.

SignDeterministic(ReadOnlySpan<byte>, ReadOnlySpan<byte>, ReadOnlySpan<byte>, Span<byte>)

Signs a message using the deterministic variant of ML-DSA (rnd = 0³²).

void SignDeterministic(ReadOnlySpan<byte> secretKey, ReadOnlySpan<byte> message, ReadOnlySpan<byte> context, Span<byte> signature)

Parameters

secretKey ReadOnlySpan<byte>

The secret key.

message ReadOnlySpan<byte>

The message to sign.

context ReadOnlySpan<byte>

The optional context string (at most 255 bytes).

signature Span<byte>

The buffer to receive the signature.

Remarks

Hedged signing (see Sign(ReadOnlySpan<byte>, ReadOnlySpan<byte>, ReadOnlySpan<byte>, Span<byte>)) is the FIPS 204 default and should be preferred; the deterministic variant exists for reproducibility requirements and known-answer testing.

Exceptions

ArgumentException

A parameter has an invalid size.

Verify(ReadOnlySpan<byte>, ReadOnlySpan<byte>, ReadOnlySpan<byte>, ReadOnlySpan<byte>)

Verifies a signature over a message.

bool Verify(ReadOnlySpan<byte> publicKey, ReadOnlySpan<byte> message, ReadOnlySpan<byte> context, ReadOnlySpan<byte> signature)

Parameters

publicKey ReadOnlySpan<byte>

The public key.

message ReadOnlySpan<byte>

The signed message.

context ReadOnlySpan<byte>

The context string used when signing (at most 255 bytes).

signature ReadOnlySpan<byte>

The signature to verify.

Returns

bool

True when the signature is valid for the message, key, and context.

Exceptions

ArgumentException

A parameter has an invalid size.

Edit this page