Class MLKem

Namespace

CryptoHives.Foundation.Security.Cryptography.Kem

Assembly

CryptoHives.Foundation.Security.Cryptography.dll

Represents an ML-KEM key (FIPS 203) and provides encapsulation and decapsulation.

public sealed class MLKem : IDisposable

Inheritance

object

MLKem

Implements

IDisposable

Inherited Members

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

object.GetType()

Remarks

The API shape mirrors System.Security.Cryptography.MLKem from .NET 10 so code written against the in-box type ports directly to older target frameworks, including .NET Framework and .NET Standard 2.0.

An instance holds either a full key pair (created via GenerateKey(MLKemAlgorithm), ImportPrivateSeed(MLKemAlgorithm, ReadOnlySpan<byte>), or ImportDecapsulationKey(MLKemAlgorithm, ReadOnlySpan<byte>)) or only an encapsulation key (via ImportEncapsulationKey(MLKemAlgorithm, ReadOnlySpan<byte>)). Keys generated from a seed retain the 64-byte (d ‖ z) seed, the storage format recommended by FIPS 203; keys imported from an expanded decapsulation key cannot export a seed.

Imported keys are validated with the FIPS 203 §7.2 modulus check (encapsulation keys) and §7.3 hash check (decapsulation keys). Secret key material is zeroed when the instance is disposed.

Example usage:

using var receiver = MLKem.GenerateKey(MLKemAlgorithm.MLKem768);
byte[] ek = receiver.ExportEncapsulationKey();

// Sender:
using var sender = MLKem.ImportEncapsulationKey(MLKemAlgorithm.MLKem768, ek);
byte[] ciphertext = new byte[sender.Algorithm.CiphertextSizeInBytes];
byte[] secret1 = new byte[sender.Algorithm.SharedSecretSizeInBytes];
sender.Encapsulate(ciphertext, secret1);

// Receiver:
byte[] secret2 = new byte[receiver.Algorithm.SharedSecretSizeInBytes];
receiver.Decapsulate(ciphertext, secret2);
// secret1 and secret2 are identical

Properties

Algorithm

Gets the ML-KEM parameter set of this key.

public MLKemAlgorithm Algorithm { get; }

Property Value

MLKemAlgorithm

IsSupported

Gets a value indicating whether ML-KEM is supported on the current platform.

public static bool IsSupported { get; }

Property Value

bool

Remarks

Always true. This is a fully managed implementation, so unlike System.Security.Cryptography.MLKem.IsSupported it never depends on the operating system providing ML-KEM.

Methods

Decapsulate(byte[])

Recovers the shared secret from a ciphertext using this key's decapsulation key, returning it as a new array.

public byte[] Decapsulate(byte[] ciphertext)

Parameters

ciphertext byte[]

The ciphertext; must be exactly CiphertextSizeInBytes bytes.

Returns

byte[]

The shared secret.

Remarks

ML-KEM uses implicit rejection: an invalid ciphertext of the correct length does not throw, but yields a pseudorandom secret unrelated to the sender's.

Exceptions

ArgumentNullException

ciphertext is null.

ArgumentException

ciphertext has an incorrect length.

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no decapsulation key.

Decapsulate(ReadOnlySpan<byte>, Span<byte>)

Recovers the shared secret from a ciphertext using this key's decapsulation key.

public void Decapsulate(ReadOnlySpan<byte> ciphertext, Span<byte> sharedSecret)

Parameters

ciphertext ReadOnlySpan<byte>

The ciphertext; must be exactly CiphertextSizeInBytes bytes.

sharedSecret Span<byte>

The buffer to receive the shared secret; must be exactly SharedSecretSizeInBytes bytes.

Remarks

ML-KEM uses implicit rejection: an invalid ciphertext of the correct length does not throw, but yields a pseudorandom secret unrelated to the sender's.

Exceptions

ArgumentException

A buffer has an incorrect length.

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no decapsulation key.

Dispose()

Zeroizes the private seed and decapsulation key and releases the instance.

public void Dispose()

Encapsulate(out byte[], out byte[])

Creates a ciphertext and shared secret for the holder of this key's decapsulation key, returning both as new arrays.

public void Encapsulate(out byte[] ciphertext, out byte[] sharedSecret)

Parameters

ciphertext byte[]

When this method returns, the ciphertext.

sharedSecret byte[]

When this method returns, the shared secret.

Exceptions

ObjectDisposedException

The instance has been disposed.

Encapsulate(Span<byte>, Span<byte>)

Creates a ciphertext and shared secret for the holder of this key's decapsulation key.

public void Encapsulate(Span<byte> ciphertext, Span<byte> sharedSecret)

Parameters

ciphertext Span<byte>

The buffer to receive the ciphertext; must be exactly CiphertextSizeInBytes bytes.

sharedSecret Span<byte>

The buffer to receive the shared secret; must be exactly SharedSecretSizeInBytes bytes.

Exceptions

ArgumentException

A buffer has an incorrect length.

ObjectDisposedException

The instance has been disposed.

CryptographicException

The buffers overlap.

ExportDecapsulationKey()

Exports the expanded decapsulation (private) key.

public byte[] ExportDecapsulationKey()

Returns

byte[]

The expanded decapsulation key.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no decapsulation key.

ExportDecapsulationKey(Span<byte>)

Exports the expanded decapsulation (private) key into a buffer.

public void ExportDecapsulationKey(Span<byte> destination)

Parameters

destination Span<byte>

The buffer to receive the key; must be exactly DecapsulationKeySizeInBytes bytes.

Exceptions

ArgumentException

destination has an incorrect length.

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no decapsulation key.

ExportEncapsulationKey()

Exports the encapsulation (public) key.

public byte[] ExportEncapsulationKey()

Returns

byte[]

The encapsulation key.

Exceptions

ObjectDisposedException

The instance has been disposed.

ExportEncapsulationKey(Span<byte>)

Exports the encapsulation (public) key into a buffer.

public void ExportEncapsulationKey(Span<byte> destination)

Parameters

destination Span<byte>

The buffer to receive the key; must be exactly EncapsulationKeySizeInBytes bytes.

Exceptions

ArgumentException

destination has an incorrect length.

ObjectDisposedException

The instance has been disposed.

ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte>, PbeOptions)

Exports this key in the PKCS#8 EncryptedPrivateKeyInfo format.

public byte[] ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> password, PbeOptions pbeOptions)

Parameters

password ReadOnlySpan<byte>

The password, used verbatim as the key derivation input.

pbeOptions PbeOptions

Selects the cipher, pseudorandom function and iteration count.

Returns

byte[]

The DER encoding.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<char>, PbeOptions)

Exports this key in the PKCS#8 EncryptedPrivateKeyInfo format.

public byte[] ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password, PbeOptions pbeOptions)

Parameters

password ReadOnlySpan<char>

The password.

pbeOptions PbeOptions

Selects the cipher, pseudorandom function and iteration count.

Returns

byte[]

The DER encoding.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

ExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<byte>, PbeOptions)

Exports this key in a PEM-encoded PKCS#8 EncryptedPrivateKeyInfo.

public string ExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<byte> password, PbeOptions pbeOptions)

Parameters

password ReadOnlySpan<byte>

The password, used verbatim as the key derivation input.

pbeOptions PbeOptions

Selects the cipher, pseudorandom function and iteration count.

Returns

string

The PEM text, labelled ENCRYPTED PRIVATE KEY.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

ExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<char>, PbeOptions)

Exports this key in a PEM-encoded PKCS#8 EncryptedPrivateKeyInfo.

public string ExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<char> password, PbeOptions pbeOptions)

Parameters

password ReadOnlySpan<char>

The password.

pbeOptions PbeOptions

Selects the cipher, pseudorandom function and iteration count.

Returns

string

The PEM text, labelled ENCRYPTED PRIVATE KEY.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

ExportPkcs8PrivateKey()

Exports this key in the PKCS#8 PrivateKeyInfo format.

public byte[] ExportPkcs8PrivateKey()

Returns

byte[]

The DER encoding.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

ExportPrivateSeed()

Exports the 64-byte private seed (d ‖ z).

public byte[] ExportPrivateSeed()

Returns

byte[]

The private seed.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The key was not created from a seed.

ExportPrivateSeed(Span<byte>)

Exports the 64-byte private seed (d ‖ z) into a buffer.

public void ExportPrivateSeed(Span<byte> destination)

Parameters

destination Span<byte>

The buffer to receive the seed; must be exactly PrivateSeedSizeInBytes bytes.

Exceptions

ArgumentException

destination has an incorrect length.

ObjectDisposedException

The instance has been disposed.

CryptographicException

The key was not created from a seed.

ExportSubjectPublicKeyInfo()

Exports the encapsulation key in the X.509 SubjectPublicKeyInfo format.

public byte[] ExportSubjectPublicKeyInfo()

Returns

byte[]

The DER encoding.

Exceptions

ObjectDisposedException

The instance has been disposed.

ExportSubjectPublicKeyInfoPem()

Exports the encapsulation key in a PEM-encoded SubjectPublicKeyInfo.

public string ExportSubjectPublicKeyInfoPem()

Returns

string

The PEM text, labelled PUBLIC KEY.

Exceptions

ObjectDisposedException

The instance has been disposed.

GenerateKey(MLKemAlgorithm)

Generates a new ML-KEM key pair.

public static MLKem GenerateKey(MLKemAlgorithm algorithm)

Parameters

algorithm MLKemAlgorithm

The parameter set to generate a key for.

Returns

MLKem

A new instance holding the generated key pair and its private seed.

Exceptions

ArgumentNullException

algorithm is null.

GenerateKey(MLKemAlgorithm, bool)

Generates a new ML-KEM key pair, optionally skipping the pairwise consistency test.

public static MLKem GenerateKey(MLKemAlgorithm algorithm, bool pairwiseConsistencyTest)

Parameters

algorithm MLKemAlgorithm

The parameter set to generate a key for.

pairwiseConsistencyTest bool

true to verify the generated key pair with an encapsulate/decapsulate round trip; false to skip it.

Returns

MLKem

A new instance holding the generated key pair and its private seed.

Remarks

The pairwise consistency test verifies a freshly expanded key pair by running one encapsulate/decapsulate round trip, as FIPS 140-3 IG 10.3.A expects of a validated module. It costs roughly four fifths of key generation, because that round trip is a full encapsulation plus a full decapsulation.

It guards against a fault — bad memory, a bit flip, a miscompiled build — producing a key pair that does not round-trip. It cannot catch an implementation bug, since both halves of the test would be wrong in the same way. Disable it only where that trade is understood and key generation throughput actually matters; the default on the BCL-shaped overloads keeps it enabled.

Exceptions

ArgumentNullException

algorithm is null.

CryptographicException

The key pair failed the consistency test.

GetPkcs8PrivateKeyPemSize()

Gets the exact number of characters TryExportPkcs8PrivateKeyPem(Span<char>, out int) writes for this key.

public int GetPkcs8PrivateKeyPemSize()

Returns

int

The required buffer length, in characters.

Remarks

The counterpart of System.Security.Cryptography.PemEncoding.GetEncodedSize, which is not available on every target framework this library supports. Rent a buffer of this size, call TryExportPkcs8PrivateKeyPem(Span<char>, out int), and clear the buffer when finished.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

GetSubjectPublicKeyInfoPemSize()

Gets the exact number of characters TryExportSubjectPublicKeyInfoPem(Span<char>, out int) writes.

public int GetSubjectPublicKeyInfoPemSize()

Returns

int

The required buffer length, in characters.

Exceptions

ObjectDisposedException

The instance has been disposed.

ImportDecapsulationKey(MLKemAlgorithm, byte[])

Imports an expanded ML-KEM decapsulation key.

public static MLKem ImportDecapsulationKey(MLKemAlgorithm algorithm, byte[] source)

Parameters

algorithm MLKemAlgorithm

The parameter set of the key.

source byte[]

The expanded decapsulation key.

Returns

MLKem

A new instance holding the key pair.

Remarks

The key is validated with the FIPS 203 §7.3 hash check. A key imported this way holds no private seed, so ExportPrivateSeed() is unavailable.

Exceptions

ArgumentNullException

algorithm or source is null.

ArgumentException

source has an invalid length.

CryptographicException

The key failed the FIPS 203 §7.3 hash check.

ImportDecapsulationKey(MLKemAlgorithm, ReadOnlySpan<byte>)

Imports an expanded ML-KEM decapsulation key.

public static MLKem ImportDecapsulationKey(MLKemAlgorithm algorithm, ReadOnlySpan<byte> source)

Parameters

algorithm MLKemAlgorithm

The parameter set of the key.

source ReadOnlySpan<byte>

The expanded decapsulation key.

Returns

MLKem

A new instance holding the key pair.

Remarks

The key is validated with the FIPS 203 §7.3 hash check. A key imported this way holds no private seed, so ExportPrivateSeed() is unavailable.

Exceptions

ArgumentNullException

algorithm is null.

ArgumentException

source has an invalid length.

CryptographicException

The key failed the FIPS 203 §7.3 hash check.

ImportEncapsulationKey(MLKemAlgorithm, byte[])

Imports an ML-KEM encapsulation (public) key.

public static MLKem ImportEncapsulationKey(MLKemAlgorithm algorithm, byte[] source)

Parameters

algorithm MLKemAlgorithm

The parameter set of the key.

source byte[]

The encapsulation key.

Returns

MLKem

A new instance holding only the public key.

Remarks

The key is validated with the FIPS 203 §7.2 modulus check. The resulting instance can encapsulate but not decapsulate.

Exceptions

ArgumentNullException

algorithm or source is null.

ArgumentException

source has an invalid length.

CryptographicException

The key failed the FIPS 203 §7.2 modulus check.

ImportEncapsulationKey(MLKemAlgorithm, ReadOnlySpan<byte>)

Imports an ML-KEM encapsulation (public) key.

public static MLKem ImportEncapsulationKey(MLKemAlgorithm algorithm, ReadOnlySpan<byte> source)

Parameters

algorithm MLKemAlgorithm

The parameter set of the key.

source ReadOnlySpan<byte>

The encapsulation key.

Returns

MLKem

A new instance holding only the public key.

Remarks

The key is validated with the FIPS 203 §7.2 modulus check. The resulting instance can encapsulate but not decapsulate.

Exceptions

ArgumentNullException

algorithm is null.

ArgumentException

source has an invalid length.

CryptographicException

The key failed the FIPS 203 §7.2 modulus check.

ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte>, ReadOnlySpan<byte>)

Imports an ML-KEM private key from a PKCS#8 EncryptedPrivateKeyInfo structure.

public static MLKem ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> password, ReadOnlySpan<byte> source)

Parameters

password ReadOnlySpan<byte>

The password, used verbatim as the key derivation input.

source ReadOnlySpan<byte>

The DER-encoded EncryptedPrivateKeyInfo.

Returns

MLKem

The imported key.

Exceptions

CryptographicException

The password is wrong, or the structure is malformed or is not ML-KEM.

ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<char>, ReadOnlySpan<byte>)

Imports an ML-KEM private key from a PKCS#8 EncryptedPrivateKeyInfo structure.

public static MLKem ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password, ReadOnlySpan<byte> source)

Parameters

password ReadOnlySpan<char>

The password, encoded per the scheme in the structure.

source ReadOnlySpan<byte>

The DER-encoded EncryptedPrivateKeyInfo.

Returns

MLKem

The imported key.

Exceptions

CryptographicException

The password is wrong, or the structure is malformed or is not ML-KEM.

ImportFromEncryptedPem(ReadOnlySpan<char>, ReadOnlySpan<byte>)

Imports an ML-KEM key from an encrypted RFC 7468 PEM-encoded string.

public static MLKem ImportFromEncryptedPem(ReadOnlySpan<char> source, ReadOnlySpan<byte> passwordBytes)

Parameters

source ReadOnlySpan<char>

The PEM text.

passwordBytes ReadOnlySpan<byte>

The password, used verbatim as the key derivation input.

Returns

MLKem

The imported key.

Exceptions

ArgumentException

source contains no encrypted private key, or more than one.

ImportFromEncryptedPem(ReadOnlySpan<char>, ReadOnlySpan<char>)

Imports an ML-KEM key from an encrypted RFC 7468 PEM-encoded string.

public static MLKem ImportFromEncryptedPem(ReadOnlySpan<char> source, ReadOnlySpan<char> password)

Parameters

source ReadOnlySpan<char>

The PEM text.

password ReadOnlySpan<char>

The password.

Returns

MLKem

The imported key.

Exceptions

ArgumentException

source contains no encrypted private key, or more than one.

ImportFromEncryptedPem(string, byte[])

Imports an ML-KEM key from an encrypted RFC 7468 PEM-encoded string.

public static MLKem ImportFromEncryptedPem(string source, byte[] passwordBytes)

Parameters

source string

The PEM text.

passwordBytes byte[]

The password, used verbatim as the key derivation input.

Returns

MLKem

The imported key.

Exceptions

ArgumentNullException

An argument is null.

ArgumentException

source contains no encrypted private key, or more than one.

ImportFromPem(ReadOnlySpan<char>)

Imports an ML-KEM key from an RFC 7468 PEM-encoded string.

public static MLKem ImportFromPem(ReadOnlySpan<char> source)

Parameters

source ReadOnlySpan<char>

The PEM text.

Returns

MLKem

The imported key.

Exceptions

ArgumentException

source contains no PEM block with a recognized label, or more than one.

ImportPkcs8PrivateKey(byte[])

Imports an ML-KEM private key from a PKCS#8 PrivateKeyInfo structure.

public static MLKem ImportPkcs8PrivateKey(byte[] source)

Parameters

source byte[]

The DER-encoded PrivateKeyInfo.

Returns

MLKem

The imported key.

Exceptions

ArgumentNullException

source is null.

CryptographicException

The structure is malformed or is not ML-KEM.

ImportPkcs8PrivateKey(ReadOnlySpan<byte>)

Imports an ML-KEM private key from a PKCS#8 PrivateKeyInfo structure.

public static MLKem ImportPkcs8PrivateKey(ReadOnlySpan<byte> source)

Parameters

source ReadOnlySpan<byte>

The DER-encoded PrivateKeyInfo.

Returns

MLKem

The imported key.

Exceptions

CryptographicException

The structure is malformed or is not ML-KEM.

ImportPrivateSeed(MLKemAlgorithm, byte[])

Imports an ML-KEM private seed (d ‖ z) and expands it into a key pair.

public static MLKem ImportPrivateSeed(MLKemAlgorithm algorithm, byte[] source)

Parameters

algorithm MLKemAlgorithm

The parameter set of the key.

source byte[]

The 64-byte private seed.

Returns

MLKem

A new instance holding the key pair and the seed.

Exceptions

ArgumentNullException

algorithm or source is null.

ArgumentException

source has an invalid length.

ImportPrivateSeed(MLKemAlgorithm, ReadOnlySpan<byte>)

Imports an ML-KEM private seed (d ‖ z) and expands it into a key pair.

public static MLKem ImportPrivateSeed(MLKemAlgorithm algorithm, ReadOnlySpan<byte> source)

Parameters

algorithm MLKemAlgorithm

The parameter set of the key.

source ReadOnlySpan<byte>

The 64-byte private seed.

Returns

MLKem

A new instance holding the key pair and the seed.

Exceptions

ArgumentNullException

algorithm is null.

ArgumentException

source has an invalid length.

ImportPrivateSeed(MLKemAlgorithm, ReadOnlySpan<byte>, bool)

Imports an ML-KEM private seed (d ‖ z) and expands it into a key pair, optionally skipping the pairwise consistency test.

public static MLKem ImportPrivateSeed(MLKemAlgorithm algorithm, ReadOnlySpan<byte> source, bool pairwiseConsistencyTest)

Parameters

algorithm MLKemAlgorithm

The parameter set of the key.

source ReadOnlySpan<byte>

The 64-byte private seed.

pairwiseConsistencyTest bool

true to verify the expanded key pair; false to skip it.

Returns

MLKem

A new instance holding the key pair and the seed.

Remarks

The pairwise consistency test verifies a freshly expanded key pair by running one encapsulate/decapsulate round trip, as FIPS 140-3 IG 10.3.A expects of a validated module. It costs roughly four fifths of key generation, because that round trip is a full encapsulation plus a full decapsulation.

It guards against a fault — bad memory, a bit flip, a miscompiled build — producing a key pair that does not round-trip. It cannot catch an implementation bug, since both halves of the test would be wrong in the same way. Disable it only where that trade is understood and key generation throughput actually matters; the default on the BCL-shaped overloads keeps it enabled.

Exceptions

ArgumentNullException

algorithm is null.

ArgumentException

source has an invalid length.

CryptographicException

The key pair failed the consistency test.

ImportSubjectPublicKeyInfo(byte[])

Imports an ML-KEM encapsulation key from an X.509 SubjectPublicKeyInfo structure.

public static MLKem ImportSubjectPublicKeyInfo(byte[] source)

Parameters

source byte[]

The DER-encoded SubjectPublicKeyInfo.

Returns

MLKem

An encapsulation-only instance.

Exceptions

ArgumentNullException

source is null.

CryptographicException

The structure is malformed or is not ML-KEM.

ImportSubjectPublicKeyInfo(ReadOnlySpan<byte>)

Imports an ML-KEM encapsulation key from an X.509 SubjectPublicKeyInfo structure.

public static MLKem ImportSubjectPublicKeyInfo(ReadOnlySpan<byte> source)

Parameters

source ReadOnlySpan<byte>

The DER-encoded SubjectPublicKeyInfo.

Returns

MLKem

An encapsulation-only instance.

Exceptions

CryptographicException

The structure is malformed or is not ML-KEM.

TryExportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte>, PbeOptions, Span<byte>, out int)

Attempts to export this key in the PKCS#8 EncryptedPrivateKeyInfo format.

public bool TryExportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> password, PbeOptions pbeOptions, Span<byte> destination, out int bytesWritten)

Parameters

password ReadOnlySpan<byte>

The password, used verbatim as the key derivation input.

pbeOptions PbeOptions

Selects the cipher, pseudorandom function and iteration count.

destination Span<byte>

The buffer to receive the encoding.

bytesWritten int

The number of bytes written.

Returns

bool

false when destination is too small.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

TryExportEncryptedPkcs8PrivateKey(ReadOnlySpan<char>, PbeOptions, Span<byte>, out int)

Attempts to export this key in the PKCS#8 EncryptedPrivateKeyInfo format.

public bool TryExportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password, PbeOptions pbeOptions, Span<byte> destination, out int bytesWritten)

Parameters

password ReadOnlySpan<char>

The password.

pbeOptions PbeOptions

Selects the cipher, pseudorandom function and iteration count.

destination Span<byte>

The buffer to receive the encoding.

bytesWritten int

The number of bytes written.

Returns

bool

false when destination is too small.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

TryExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<byte>, PbeOptions, Span<char>, out int)

Attempts to export this key as a PEM-encoded PKCS#8 EncryptedPrivateKeyInfo.

public bool TryExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<byte> password, PbeOptions pbeOptions, Span<char> destination, out int charsWritten)

Parameters

password ReadOnlySpan<byte>

The password, used verbatim as the key derivation input.

pbeOptions PbeOptions

Selects the cipher, pseudorandom function and iteration count.

destination Span<char>

The buffer to receive the text.

charsWritten int

The number of characters written.

Returns

bool

false when destination is too small.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

TryExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<char>, PbeOptions, Span<char>, out int)

Attempts to export this key as a PEM-encoded PKCS#8 EncryptedPrivateKeyInfo.

public bool TryExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<char> password, PbeOptions pbeOptions, Span<char> destination, out int charsWritten)

Parameters

password ReadOnlySpan<char>

The password, encoded per the scheme being written.

pbeOptions PbeOptions

Selects the cipher, pseudorandom function and iteration count.

destination Span<char>

The buffer to receive the text.

charsWritten int

The number of characters written.

Returns

bool

false when destination is too small.

Remarks

There is no size helper for this member: measuring the output means running the key derivation function, which at a realistic iteration count is the whole cost of the export. Use ExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<char>, PbeOptions) - safe, because the payload is ciphertext - or grow a buffer until this succeeds.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

TryExportPkcs8PrivateKey(Span<byte>, out int)

Attempts to export this key in the PKCS#8 PrivateKeyInfo format.

public bool TryExportPkcs8PrivateKey(Span<byte> destination, out int bytesWritten)

Parameters

destination Span<byte>

The buffer to receive the encoding.

bytesWritten int

The number of bytes written.

Returns

bool

false when destination is too small.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

TryExportPkcs8PrivateKeyPem(Span<char>, out int)

Attempts to export this key as a PEM-encoded PKCS#8 PrivateKeyInfo, writing into a buffer the caller owns and can erase.

public bool TryExportPkcs8PrivateKeyPem(Span<char> destination, out int charsWritten)

Parameters

destination Span<char>

The buffer to receive the text, labelled PRIVATE KEY.

charsWritten int

The number of characters written.

Returns

bool

false when destination is too small.

Remarks

There is no allocating ExportPkcs8PrivateKeyPem(). The text this produces is the private key, and a string holding it could never be erased - so the only export this type offers is one that writes where the caller can clear it afterwards. Size the buffer with GetPkcs8PrivateKeyPemSize().

When the buffer is too small nothing is written and charsWritten is zero.

Exceptions

ObjectDisposedException

The instance has been disposed.

CryptographicException

The instance holds no private key.

TryExportSubjectPublicKeyInfo(Span<byte>, out int)

Attempts to export the encapsulation key as a SubjectPublicKeyInfo.

public bool TryExportSubjectPublicKeyInfo(Span<byte> destination, out int bytesWritten)

Parameters

destination Span<byte>

The buffer to receive the encoding.

bytesWritten int

The number of bytes written.

Returns

bool

false when destination is too small.

Exceptions

ObjectDisposedException

The instance has been disposed.

TryExportSubjectPublicKeyInfoPem(Span<char>, out int)

Attempts to export this key as a PEM-encoded SubjectPublicKeyInfo.

public bool TryExportSubjectPublicKeyInfoPem(Span<char> destination, out int charsWritten)

Parameters

destination Span<char>

The buffer to receive the text, labelled PUBLIC KEY.

charsWritten int

The number of characters written.

Returns

bool

false when destination is too small.

Remarks

A public key is not secret, so ExportSubjectPublicKeyInfoPem() remains available and is usually the simpler call. This overload exists for parity with AsymmetricAlgorithm, which offers the same pair, and for callers avoiding allocation.

Exceptions

ObjectDisposedException

The instance has been disposed.