Struct PqxdhPrekeyBundle 

pub struct PqxdhPrekeyBundle {
    pub signed_prekey: PublicKey,
    pub signed_prekey_signature: Signature,
    pub signed_prekey_id: String,
    pub one_time_prekeys: BTreeMap<String, PublicKey>,
    pub pq_signed_prekey: Vec<u8>,
    pub pq_signed_prekey_signature: Signature,
    pub pq_signed_prekey_id: String,
    pub pq_one_time_keys: BTreeMap<String, Vec<u8>>,
    pub pq_one_time_signatures: BTreeMap<String, Signature>,
}

PQXDH prekey bundle containing both classical and post-quantum keys

This bundle contains all the cryptographic material needed for a client to initiate a PQXDH key agreement with the bundle owner.

Security Properties

• Hybrid Security: Combines X25519 (classical) and ML-KEM (post-quantum)
• Forward Secrecy: One-time keys provide perfect forward secrecy
• Authentication: All keys are signed by the identity key
• Key Rotation: Signed prekeys are rotated periodically

Fields

signed_prekey: PublicKey

Medium-term X25519 public key for ECDH, rotated periodically

signed_prekey_signature: Signature

Signature over the signed prekey by the identity key

signed_prekey_id: String

Unique identifier for this signed prekey

one_time_prekeys: BTreeMap<String, PublicKey>

One-time X25519 public keys (each used exactly once)

pq_signed_prekey: Vec<u8>

Medium-term ML-KEM public key, rotated periodically

pq_signed_prekey_signature: Signature

Signature over the PQ signed prekey by the identity key

pq_signed_prekey_id: String

Unique identifier for this PQ signed prekey

pq_one_time_keys: BTreeMap<String, Vec<u8>>

One-time ML-KEM public keys (each used exactly once)

pq_one_time_signatures: BTreeMap<String, Signature>

Signatures over each one-time PQ key by the identity key

Implementations

impl PqxdhPrekeyBundle

pub fn verify_signatures( &self, identity_key: &VerifyingKey, ) -> Result<(), PqxdhError>

Verify all signatures in the prekey bundle

This checks that all prekeys are properly signed by the given identity key.

Verification Process

1. Verifies signed_prekey_signature over signed_prekey bytes
2. Verifies pq_signed_prekey_signature over pq_signed_prekey bytes
3. Verifies each pq_one_time_signatures over their respective pq_one_time_keys
4. Ensures all PQ one-time keys have corresponding signatures (no missing or extra signatures)

Security Properties

• Authentication: Proves all keys were signed by the identity key holder
• Integrity: Detects any tampering with prekey data after signing
• Completeness: Ensures signature coverage matches key availability

Returns

• Ok(()) if all signatures are valid and complete
• Err(PqxdhError::SignatureVerificationFailed) if any signature is invalid or missing

pub fn one_time_key_count(&self) -> usize

Get the number of available one-time keys

pub fn has_one_time_keys(&self) -> bool

Check if the bundle has any one-time keys available

Trait Implementations

impl Clone for PqxdhPrekeyBundle

fn clone(&self) -> PqxdhPrekeyBundle

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PqxdhPrekeyBundle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PqxdhPrekeyBundle

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for PqxdhPrekeyBundle

fn eq(&self, other: &PqxdhPrekeyBundle) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for PqxdhPrekeyBundle

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PqxdhPrekeyBundle