Struct KeyProof 

pub struct KeyProof {
    pub public_key: VerifyingKey,
    pub signature: Signature,
}

Cryptographic proof of ML-DSA private key possession

Each proof consists of a public key and a signature that demonstrates the client possesses the corresponding private key. The signature is computed over challenge-specific data to prevent replay attacks.

Verification Process

The server verifies each proof by:

1. Decoding the ML-DSA public key from public_key
2. Reconstructing signature data: nonce || server_public_key
3. Verifying the signature using the public key and signature data
4. Adding successfully verified keys to the connection’s verified set

Key Encoding

ML-DSA public keys must be encoded using the standard ML-DSA encoding:

• ML-DSA-44: 1312 bytes
• ML-DSA-65: 1952 bytes
• ML-DSA-87: 2592 bytes

This implementation uses ML-DSA-65 (security level 3, ~192-bit security).

Fields

public_key: VerifyingKey

Encoded ML-DSA public key being proven

This should be the result of calling verifying_key.encode() on an ML-DSA verifying key. The encoding includes all necessary information to reconstruct the public key for verification.

signature: Signature

ML-DSA signature over (nonce || server_public_key)

This signature proves possession of the private key corresponding to public_key. It must be computed over the exact concatenation of the challenge nonce and server public key.

Signature sizes:

• ML-DSA-44: ~2420 bytes
• ML-DSA-65: ~3309 bytes
• ML-DSA-87: ~4627 bytes

Trait Implementations

impl Clone for KeyProof

fn clone(&self) -> KeyProof

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyProof

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for KeyProof

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for KeyProof

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.