pq_crypto 0.5.2 → 0.6.0

data/lib/pq_crypto/pkcs8.rb

@@ -7,8 +7,16 @@ module PQCrypto
     PEM_LABEL = "PRIVATE KEY"
     PEM_BEGIN = "-----BEGIN #{PEM_LABEL}-----"
     PEM_END = "-----END #{PEM_LABEL}-----"
+    ENCRYPTED_PEM_LABEL = "ENCRYPTED PRIVATE KEY"
+    ENCRYPTED_PEM_BEGIN = "-----BEGIN #{ENCRYPTED_PEM_LABEL}-----"
+    ENCRYPTED_PEM_END = "-----END #{ENCRYPTED_PEM_LABEL}-----"
     ML_KEM_SEED_BYTES = 64
     ML_DSA_SEED_BYTES = 32
+    PBES2_OID = "1.2.840.113549.1.5.13"
+    PBKDF2_OID = "1.2.840.113549.1.5.12"
+    HMAC_SHA256_OID = "1.2.840.113549.2.9"
+    AES_256_CBC_OID = "2.16.840.1.101.3.4.1.42"
+    ENCRYPTED_PKCS8_DEFAULT_ITERATIONS = 200_000
 
     @allow_ml_dsa_seed_format = false
 
@@ -48,7 +56,7 @@ module PQCrypto
     class << self
       attr_accessor :allow_ml_dsa_seed_format
 
-      def encode_der(algorithm_symbol, secret_material, format:)
+      def encode_der(algorithm_symbol, secret_material, format:, passphrase: nil, iterations: ENCRYPTED_PKCS8_DEFAULT_ITERATIONS)
         entry = AlgorithmRegistry.fetch(algorithm_symbol)
         validate_secret_key_algorithm!(algorithm_symbol, entry)
         ensure_format_supported!(algorithm_symbol, format)
@@ -64,28 +72,51 @@ module PQCrypto
                        raise SerializationError, "Unsupported PKCS#8 private key format: #{format.inspect}"
                      end
 
-        OpenSSL::ASN1::Sequence.new([
+        der = OpenSSL::ASN1::Sequence.new([
           OpenSSL::ASN1::Integer.new(0),
           OpenSSL::ASN1::Sequence.new([
             OpenSSL::ASN1::ObjectId.new(AlgorithmRegistry.standard_oid(algorithm_symbol)),
           ]),
           OpenSSL::ASN1::OctetString.new(choice_der),
         ]).to_der.b
+
+        return der if passphrase.nil?
+
+        encrypt_der(der, passphrase: passphrase, iterations: iterations)
       rescue OpenSSL::ASN1::ASN1Error => e
         raise SerializationError, e.message
+      ensure
+        safe_wipe(choice_der) if defined?(choice_der)
+        safe_wipe(der) if passphrase && defined?(der)
       end
 
-      def encode_pem(algorithm_symbol, secret_material, format:)
-        der = encode_der(algorithm_symbol, secret_material, format: format)
+      def encode_pem(algorithm_symbol, secret_material, format:, passphrase: nil, iterations: ENCRYPTED_PKCS8_DEFAULT_ITERATIONS)
+        der = encode_der(algorithm_symbol, secret_material, format: format, passphrase: passphrase, iterations: iterations)
         body = encode_base64(der).scan(/.{1,64}/).join("\n")
-        "#{PEM_BEGIN}\n#{body}\n#{PEM_END}\n"
+        if passphrase.nil?
+          "#{PEM_BEGIN}\n#{body}\n#{PEM_END}\n"
+        else
+          "#{ENCRYPTED_PEM_BEGIN}\n#{body}\n#{ENCRYPTED_PEM_END}\n"
+        end
       end
 
-      def decode_der(der)
+      def decode_der(der, passphrase: nil)
         input = String(der).b
         outer = decode_asn1(input)
         raise SerializationError, "PKCS#8 DER contains trailing data" unless outer.to_der.b == input
         raise SerializationError, "PKCS#8 must be an ASN.1 SEQUENCE" unless outer.is_a?(OpenSSL::ASN1::Sequence)
+
+        if encrypted_private_key_info?(outer)
+          raise SerializationError, "Encrypted PKCS#8 requires passphrase" if passphrase.nil?
+
+          plain_der = decrypt_der(outer, passphrase: passphrase)
+          begin
+            return decode_der(plain_der)
+          ensure
+            safe_wipe(plain_der)
+          end
+        end
+
         raise SerializationError, "PKCS#8 OneAsymmetricKey must contain exactly 3 elements" unless outer.value.size == 3
 
         version, algorithm_identifier, private_key = outer.value
@@ -101,9 +132,9 @@ module PQCrypto
         decode_private_key_choice(algorithm, String(private_key.value).b)
       end
 
-      def decode_pem(pem)
+      def decode_pem(pem, passphrase: nil)
         der = der_from_pem(pem)
-        decode_der(der)
+        decode_der(der, passphrase: passphrase)
       end
 
       private
@@ -114,6 +145,146 @@ module PQCrypto
         raise SerializationError, e.message
       end
 
+      def safe_wipe(value)
+        return unless value.is_a?(String) && !value.frozen?
+
+        PQCrypto.secure_wipe(value)
+      rescue ArgumentError
+        nil
+      end
+
+      def encrypt_der(der, passphrase:, iterations:)
+        passphrase = String(passphrase)
+        iterations = Integer(iterations)
+        raise SerializationError, "Encrypted PKCS#8 iterations must be positive" unless iterations.positive?
+
+        salt = OpenSSL::Random.random_bytes(16)
+        cipher = OpenSSL::Cipher.new("AES-256-CBC")
+        cipher.encrypt
+        iv = cipher.random_iv
+        key = OpenSSL::PKCS5.pbkdf2_hmac(passphrase, salt, iterations, 32, OpenSSL::Digest::SHA256.new)
+        cipher.key = key
+        encrypted = cipher.update(String(der).b) + cipher.final
+        PQCrypto.secure_wipe(key) if key && !key.frozen?
+
+        encrypted_private_key_info_der(salt, iterations, iv, encrypted)
+      rescue ArgumentError, OpenSSL::Cipher::CipherError => e
+        raise SerializationError, e.message
+      end
+
+      def decrypt_der(outer, passphrase:)
+        salt, iterations, iv, encrypted = decode_encrypted_private_key_info(outer)
+        key = OpenSSL::PKCS5.pbkdf2_hmac(String(passphrase), salt, iterations, 32, OpenSSL::Digest::SHA256.new)
+        cipher = OpenSSL::Cipher.new("AES-256-CBC")
+        cipher.decrypt
+        cipher.key = key
+        cipher.iv = iv
+        (cipher.update(encrypted) + cipher.final).b
+      rescue ArgumentError, OpenSSL::Cipher::CipherError => e
+        raise SerializationError, "Failed to decrypt PKCS#8 private key: #{e.message}"
+      ensure
+        PQCrypto.secure_wipe(key) if defined?(key) && key && !key.frozen?
+      end
+
+      def encrypted_private_key_info_der(salt, iterations, iv, encrypted)
+        OpenSSL::ASN1::Sequence.new([
+          OpenSSL::ASN1::Sequence.new([
+            OpenSSL::ASN1::ObjectId.new(PBES2_OID),
+            OpenSSL::ASN1::Sequence.new([
+              OpenSSL::ASN1::Sequence.new([
+                OpenSSL::ASN1::ObjectId.new(PBKDF2_OID),
+                OpenSSL::ASN1::Sequence.new([
+                  OpenSSL::ASN1::OctetString.new(salt),
+                  OpenSSL::ASN1::Integer.new(iterations),
+                  OpenSSL::ASN1::Integer.new(32),
+                  OpenSSL::ASN1::Sequence.new([
+                    OpenSSL::ASN1::ObjectId.new(HMAC_SHA256_OID),
+                    OpenSSL::ASN1::Null.new(nil),
+                  ]),
+                ]),
+              ]),
+              OpenSSL::ASN1::Sequence.new([
+                OpenSSL::ASN1::ObjectId.new(AES_256_CBC_OID),
+                OpenSSL::ASN1::OctetString.new(iv),
+              ]),
+            ]),
+          ]),
+          OpenSSL::ASN1::OctetString.new(encrypted),
+        ]).to_der.b
+      rescue OpenSSL::ASN1::ASN1Error => e
+        raise SerializationError, e.message
+      end
+
+      def encrypted_private_key_info?(outer)
+        outer.value.size == 2 &&
+          outer.value.first.is_a?(OpenSSL::ASN1::Sequence) &&
+          outer.value.first.value.first.is_a?(OpenSSL::ASN1::ObjectId) &&
+          outer.value.first.value.first.oid == PBES2_OID
+      end
+
+      def decode_encrypted_private_key_info(outer)
+        raise SerializationError, "Encrypted PKCS#8 must contain exactly 2 elements" unless outer.value.size == 2
+
+        algorithm_identifier, encrypted_data = outer.value
+        raise SerializationError, "Encrypted PKCS#8 encryptedData must be an OCTET STRING" unless encrypted_data.is_a?(OpenSSL::ASN1::OctetString)
+        raise SerializationError, "Encrypted PKCS#8 algorithm must be an AlgorithmIdentifier SEQUENCE" unless algorithm_identifier.is_a?(OpenSSL::ASN1::Sequence)
+        raise SerializationError, "Encrypted PKCS#8 AlgorithmIdentifier must contain PBES2 parameters" unless algorithm_identifier.value.size == 2
+
+        pbes2_oid, pbes2_params = algorithm_identifier.value
+        raise SerializationError, "Encrypted PKCS#8 algorithm must be PBES2" unless pbes2_oid.is_a?(OpenSSL::ASN1::ObjectId) && pbes2_oid.oid == PBES2_OID
+        raise SerializationError, "PBES2 parameters must be a SEQUENCE" unless pbes2_params.is_a?(OpenSSL::ASN1::Sequence)
+        raise SerializationError, "PBES2 parameters must contain KDF and encryption scheme" unless pbes2_params.value.size == 2
+
+        salt, iterations = decode_pbkdf2_params(pbes2_params.value[0])
+        iv = decode_aes256_cbc_params(pbes2_params.value[1])
+        [salt, iterations, iv, String(encrypted_data.value).b]
+      end
+
+      def decode_pbkdf2_params(kdf_alg)
+        raise SerializationError, "PBES2 KDF must be an AlgorithmIdentifier SEQUENCE" unless kdf_alg.is_a?(OpenSSL::ASN1::Sequence)
+        raise SerializationError, "PBES2 KDF AlgorithmIdentifier must contain parameters" unless kdf_alg.value.size == 2
+
+        oid, params = kdf_alg.value
+        raise SerializationError, "PBES2 KDF must be PBKDF2" unless oid.is_a?(OpenSSL::ASN1::ObjectId) && oid.oid == PBKDF2_OID
+        raise SerializationError, "PBKDF2 params must be a SEQUENCE" unless params.is_a?(OpenSSL::ASN1::Sequence)
+        raise SerializationError, "PBKDF2 params must contain salt, iteration count, key length, and PRF" unless params.value.size == 4
+
+        salt_asn1, iterations_asn1, key_length_asn1, prf_alg = params.value
+        raise SerializationError, "PBKDF2 salt must be an OCTET STRING" unless salt_asn1.is_a?(OpenSSL::ASN1::OctetString)
+        raise SerializationError, "PBKDF2 iterations must be an INTEGER" unless iterations_asn1.is_a?(OpenSSL::ASN1::Integer)
+        raise SerializationError, "PBKDF2 key length must be an INTEGER" unless key_length_asn1.is_a?(OpenSSL::ASN1::Integer)
+
+        iterations = iterations_asn1.value.to_i
+        key_length = key_length_asn1.value.to_i
+        raise SerializationError, "PBKDF2 iterations must be positive" unless iterations.positive?
+        raise SerializationError, "PBKDF2 key length must be 32 bytes" unless key_length == 32
+        validate_hmac_sha256_prf!(prf_alg)
+
+        [String(salt_asn1.value).b, iterations]
+      end
+
+      def validate_hmac_sha256_prf!(prf_alg)
+        raise SerializationError, "PBKDF2 PRF must be an AlgorithmIdentifier SEQUENCE" unless prf_alg.is_a?(OpenSSL::ASN1::Sequence)
+        raise SerializationError, "PBKDF2 PRF AlgorithmIdentifier must contain OID and NULL" unless prf_alg.value.size == 2
+
+        oid, null = prf_alg.value
+        raise SerializationError, "PBKDF2 PRF must be HMAC-SHA256" unless oid.is_a?(OpenSSL::ASN1::ObjectId) && oid.oid == HMAC_SHA256_OID
+        raise SerializationError, "PBKDF2 PRF parameters must be NULL" unless null.is_a?(OpenSSL::ASN1::Null)
+      end
+
+      def decode_aes256_cbc_params(encryption_scheme)
+        raise SerializationError, "PBES2 encryption scheme must be an AlgorithmIdentifier SEQUENCE" unless encryption_scheme.is_a?(OpenSSL::ASN1::Sequence)
+        raise SerializationError, "PBES2 encryption scheme must contain OID and IV" unless encryption_scheme.value.size == 2
+
+        oid, iv = encryption_scheme.value
+        raise SerializationError, "PBES2 encryption scheme must be AES-256-CBC" unless oid.is_a?(OpenSSL::ASN1::ObjectId) && oid.oid == AES_256_CBC_OID
+        raise SerializationError, "AES-256-CBC IV must be an OCTET STRING" unless iv.is_a?(OpenSSL::ASN1::OctetString)
+
+        iv_bytes = String(iv.value).b
+        raise SerializationError, "AES-256-CBC IV must be 16 bytes" unless iv_bytes.bytesize == 16
+        iv_bytes
+      end
+
       def decode_version(value)
         raise SerializationError, "PKCS#8 version must be an INTEGER" unless value.is_a?(OpenSSL::ASN1::Integer)
 
@@ -252,6 +423,8 @@ module PQCrypto
                     "seed/expandedKey inconsistency in PKCS#8 'both' encoding (RFC 9935 §8)"
                   end
         raise SerializationError, message
+      ensure
+        safe_wipe(expected_expanded) if defined?(expected_expanded)
       end
 
       def validate_seed_length!(algorithm, seed)
@@ -374,8 +547,9 @@ module PQCrypto
 
       def der_from_pem(pem)
         text = String(pem)
-        match = text.match(/\A#{Regexp.escape(PEM_BEGIN)}\r?\n(?<body>[A-Za-z0-9+\/=\r\n]+)\r?\n#{Regexp.escape(PEM_END)}[ \t\r\n]*\z/)
-        raise SerializationError, "Invalid PKCS#8 PEM: expected #{PEM_LABEL.inspect} label" unless match
+        match = text.match(/\A#{Regexp.escape(PEM_BEGIN)}\r?\n(?<body>[A-Za-z0-9+\/=\r\n]+)\r?\n#{Regexp.escape(PEM_END)}[ \t\r\n]*\z/) ||
+                text.match(/\A#{Regexp.escape(ENCRYPTED_PEM_BEGIN)}\r?\n(?<body>[A-Za-z0-9+\/=\r\n]+)\r?\n#{Regexp.escape(ENCRYPTED_PEM_END)}[ \t\r\n]*\z/)
+        raise SerializationError, "Invalid PKCS#8 PEM: expected #{PEM_LABEL.inspect} or #{ENCRYPTED_PEM_LABEL.inspect} label" unless match
 
         body = match[:body]
         raise SerializationError, "Invalid PKCS#8 PEM: embedded NUL in body" if body.include?("\0")

data/lib/pq_crypto/signature.rb

@@ -46,6 +46,10 @@ module PQCrypto
         SecretKey.new(algorithm, bytes)
       end
 
+      def secret_key_from_seed(algorithm, seed)
+        SecretKey.from_seed(resolve_algorithm!(algorithm), seed)
+      end
+
       def public_key_from_pqc_container_der(der, algorithm = nil)
         resolved_algorithm, bytes = Serialization.public_key_from_pqc_container_der(algorithm, der)
         resolve_algorithm!(resolved_algorithm)
@@ -82,12 +86,12 @@ module PQCrypto
         PublicKey.new(resolve_algorithm!(resolved_algorithm), bytes)
       end
 
-      def secret_key_from_pkcs8_der(der)
-        secret_key_from_decoded_pkcs8(*PKCS8.decode_der(der))
+      def secret_key_from_pkcs8_der(der, passphrase: nil)
+        secret_key_from_decoded_pkcs8(*PKCS8.decode_der(der, passphrase: passphrase))
       end
 
-      def secret_key_from_pkcs8_pem(pem)
-        secret_key_from_decoded_pkcs8(*PKCS8.decode_pem(pem))
+      def secret_key_from_pkcs8_pem(pem, passphrase: nil)
+        secret_key_from_decoded_pkcs8(*PKCS8.decode_pem(pem, passphrase: passphrase))
       end
 
       def details(algorithm)
@@ -114,10 +118,10 @@ module PQCrypto
           SecretKey.new(algorithm, material)
         when :seed
           _public_key, expanded = PQCrypto.__send__(native_method_for(algorithm, :keypair_from_seed), material)
-          SecretKey.new(algorithm, expanded)
+          SecretKey.new(algorithm, expanded, seed: material)
         when :both
           _seed, expanded = material
-          SecretKey.new(algorithm, expanded)
+          SecretKey.new(algorithm, expanded, seed: _seed)
         else
           raise SerializationError, "Unsupported ML-DSA PKCS#8 private key format: #{format.inspect}"
         end
@@ -145,9 +149,10 @@ module PQCrypto
         context = validate_context!(context)
         validate_io!(io)
 
+        algorithm = secret_key.algorithm
         sk_bytes = secret_key.__send__(:bytes_for_native)
         begin
-          tr = PQCrypto.__send__(:_native_mldsa_extract_tr, sk_bytes)
+          tr = PQCrypto.__send__(:_native_mldsa_extract_tr, algorithm, sk_bytes)
         rescue ArgumentError => e
           raise InvalidKeyError, e.message
         end
@@ -159,7 +164,7 @@ module PQCrypto
           _drain_io_into_builder(io, builder, chunk_size)
           mu = PQCrypto.__send__(:_native_mldsa_mu_builder_finalize, builder)
           builder_consumed = true
-          PQCrypto.__send__(:_native_mldsa_sign_mu, mu, sk_bytes)
+          PQCrypto.__send__(:_native_mldsa_sign_mu, algorithm, mu, sk_bytes)
         ensure
           PQCrypto.__send__(:_native_mldsa_mu_builder_release, builder) unless builder_consumed
           PQCrypto.secure_wipe(tr) if tr && !tr.frozen?
@@ -173,9 +178,10 @@ module PQCrypto
         context = validate_context!(context)
         validate_io!(io)
 
+        algorithm = public_key.algorithm
         pk_bytes = public_key.__send__(:bytes_for_native)
         begin
-          tr = PQCrypto.__send__(:_native_mldsa_compute_tr, pk_bytes)
+          tr = PQCrypto.__send__(:_native_mldsa_compute_tr, algorithm, pk_bytes)
         rescue ArgumentError => e
           raise InvalidKeyError, e.message
         end
@@ -188,7 +194,7 @@ module PQCrypto
           _drain_io_into_builder(io, builder, chunk_size)
           mu = PQCrypto.__send__(:_native_mldsa_mu_builder_finalize, builder)
           builder_consumed = true
-          PQCrypto.__send__(:_native_mldsa_verify_mu, mu, sig_bytes, pk_bytes)
+          PQCrypto.__send__(:_native_mldsa_verify_mu, algorithm, mu, sig_bytes, pk_bytes)
         ensure
           PQCrypto.__send__(:_native_mldsa_mu_builder_release, builder) unless builder_consumed
 
@@ -232,10 +238,7 @@ module PQCrypto
       end
 
       def validate_streaming_algorithm!(algorithm)
-        return if resolve_algorithm!(algorithm) == CANONICAL_ALGORITHM
-
-        raise UnsupportedAlgorithmError,
-              "Streaming sign_io/verify_io currently supports only #{CANONICAL_ALGORITHM.inspect}"
+        resolve_algorithm!(algorithm)
       end
     end
 
@@ -285,14 +288,17 @@ module PQCrypto
         SPKI.encode_pem(@algorithm, @bytes)
       end
 
-      def verify(message, signature)
-        PQCrypto.__send__(Signature.send(:native_method_for, @algorithm, :verify), String(message).b, String(signature).b, @bytes)
-      rescue ArgumentError => e
-        raise InvalidKeyError, e.message
+      def verify(message, signature, context: "".b)
+        context = Signature.send(:validate_context!, context)
+        begin
+          PQCrypto.__send__(Signature.send(:native_method_for, @algorithm, :verify), String(message).b, String(signature).b, @bytes, context)
+        rescue ArgumentError => e
+          raise InvalidKeyError, e.message
+        end
       end
 
-      def verify!(message, signature)
-        raise PQCrypto::VerificationError, "Verification failed" unless verify(message, signature)
+      def verify!(message, signature, context: "".b)
+        raise PQCrypto::VerificationError, "Verification failed" unless verify(message, signature, context: context)
         true
       end
 
@@ -309,7 +315,7 @@ module PQCrypto
 
       def ==(other)
         return false unless other.is_a?(PublicKey) && other.algorithm == algorithm
-        PQCrypto.__send__(:native_ct_equals, other.to_bytes, @bytes)
+        PQCrypto.__send__(:native_ct_equals, other.send(:bytes_for_native), @bytes)
       end
 
       alias eql? ==
@@ -337,10 +343,20 @@ module PQCrypto
     class SecretKey
       attr_reader :algorithm
 
-      def initialize(algorithm, bytes)
+      def initialize(algorithm, bytes, seed: nil)
         @algorithm = algorithm
         @bytes = String(bytes).b
+        @seed = seed.nil? ? nil : String(seed).b
         validate_length!
+        validate_seed_length! if @seed
+      end
+
+      def self.from_seed(algorithm, seed)
+        seed_bytes = String(seed).b
+        _public_key, expanded = PQCrypto.__send__(Signature.send(:native_method_for, algorithm, :keypair_from_seed), seed_bytes)
+        new(algorithm, expanded, seed: seed_bytes)
+      rescue ArgumentError => e
+        raise InvalidKeyError, e.message
       end
 
       def to_bytes
@@ -355,34 +371,43 @@ module PQCrypto
         Serialization.secret_key_to_pqc_container_pem(@algorithm, @bytes)
       end
 
-      def to_pkcs8_der(format: :expanded)
+      def to_pkcs8_der(format: :expanded, passphrase: nil, iterations: PKCS8::ENCRYPTED_PKCS8_DEFAULT_ITERATIONS)
         case format
         when :expanded
-          PKCS8.encode_der(@algorithm, @bytes, format: :expanded)
-        when :seed, :both
-          raise SerializationError,
-                "ML-DSA seed/both PKCS#8 export requires original seed material; use PQCrypto::PKCS8.encode_der/encode_pem directly"
+          PKCS8.encode_der(@algorithm, @bytes, format: :expanded, passphrase: passphrase, iterations: iterations)
+        when :seed
+          ensure_seed_available!(format)
+          PKCS8.encode_der(@algorithm, @seed, format: :seed, passphrase: passphrase, iterations: iterations)
+        when :both
+          ensure_seed_available!(format)
+          PKCS8.encode_der(@algorithm, [@seed, @bytes], format: :both, passphrase: passphrase, iterations: iterations)
         else
           raise SerializationError, "Unsupported PKCS#8 private key format: #{format.inspect}"
         end
       end
 
-      def to_pkcs8_pem(format: :expanded)
+      def to_pkcs8_pem(format: :expanded, passphrase: nil, iterations: PKCS8::ENCRYPTED_PKCS8_DEFAULT_ITERATIONS)
         case format
         when :expanded
-          PKCS8.encode_pem(@algorithm, @bytes, format: :expanded)
-        when :seed, :both
-          raise SerializationError,
-                "ML-DSA seed/both PKCS#8 export requires original seed material; use PQCrypto::PKCS8.encode_der/encode_pem directly"
+          PKCS8.encode_pem(@algorithm, @bytes, format: :expanded, passphrase: passphrase, iterations: iterations)
+        when :seed
+          ensure_seed_available!(format)
+          PKCS8.encode_pem(@algorithm, @seed, format: :seed, passphrase: passphrase, iterations: iterations)
+        when :both
+          ensure_seed_available!(format)
+          PKCS8.encode_pem(@algorithm, [@seed, @bytes], format: :both, passphrase: passphrase, iterations: iterations)
         else
           raise SerializationError, "Unsupported PKCS#8 private key format: #{format.inspect}"
         end
       end
 
-      def sign(message)
-        PQCrypto.__send__(Signature.send(:native_method_for, @algorithm, :sign), String(message).b, @bytes)
-      rescue ArgumentError => e
-        raise InvalidKeyError, e.message
+      def sign(message, context: "".b)
+        context = Signature.send(:validate_context!, context)
+        begin
+          PQCrypto.__send__(Signature.send(:native_method_for, @algorithm, :sign), String(message).b, @bytes, context)
+        rescue ArgumentError => e
+          raise InvalidKeyError, e.message
+        end
       end
 
       def sign_io(io, chunk_size: 1 << 20, context: "".b)
@@ -391,12 +416,13 @@ module PQCrypto
 
       def wipe!
         PQCrypto.secure_wipe(@bytes)
+        PQCrypto.secure_wipe(@seed) if @seed
         self
       end
 
       def ==(other)
         return false unless other.is_a?(SecretKey) && other.algorithm == algorithm
-        PQCrypto.__send__(:native_ct_equals, other.to_bytes, @bytes)
+        PQCrypto.__send__(:native_ct_equals, other.send(:bytes_for_native), @bytes)
       end
 
       alias eql? ==
@@ -419,6 +445,17 @@ module PQCrypto
         expected = Signature.details(@algorithm).fetch(:secret_key_bytes)
         raise InvalidKeyError, "Invalid signature secret key length" unless @bytes.bytesize == expected
       end
+
+      def validate_seed_length!
+        expected = PKCS8::PRIVATE_KEY_CHOICES.fetch(@algorithm).fetch(:seed_bytes)
+        raise InvalidKeyError, "Invalid signature seed length" unless @seed.bytesize == expected
+      end
+
+      def ensure_seed_available!(format)
+        return if @seed
+
+        raise SerializationError, "ML-DSA #{format.inspect} PKCS#8 export requires original seed material"
+      end
     end
   end
 end

data/lib/pq_crypto/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PQCrypto
-  VERSION = "0.5.2"
+  VERSION = "0.6.0"
 end

data/lib/pq_crypto.rb

@@ -37,6 +37,7 @@ require_relative "pq_crypto/pkcs8"
 require_relative "pq_crypto/kem"
 require_relative "pq_crypto/signature"
 require_relative "pq_crypto/hybrid_kem"
+require_relative "pq_crypto/key"
 
 module PQCrypto
   SUITES = {
@@ -65,6 +66,7 @@ module PQCrypto
       hybrid_kem_encapsulate
       hybrid_kem_expand_secret_key
       hybrid_kem_expand_secret_key_object
+      hybrid_kem_expanded_secret_key_wipe
       hybrid_kem_decapsulate
       hybrid_kem_decapsulate_expanded
       hybrid_kem_decapsulate_expanded_object
@@ -164,25 +166,25 @@ module PQCrypto
     KEM_KEYPAIR_METHODS = {
       ml_kem_512: :native_ml_kem_512_keypair_from_seed,
       ml_kem_768: :native_ml_kem_keypair_from_seed,
-      ml_kem_1024: :native_ml_kem_1024_keypair_from_seed,
+      ml_kem_1024: :native_ml_kem_1024_keypair_from_seed
     }.freeze
 
     KEM_ENCAPSULATE_METHODS = {
       ml_kem_512: :native_test_ml_kem_512_encapsulate_from_seed,
       ml_kem_768: :native_test_ml_kem_encapsulate_from_seed,
-      ml_kem_1024: :native_test_ml_kem_1024_encapsulate_from_seed,
+      ml_kem_1024: :native_test_ml_kem_1024_encapsulate_from_seed
     }.freeze
 
     MLDSA_KEYPAIR_METHODS = {
       ml_dsa_44: :native_test_ml_dsa_44_keypair_from_seed,
       ml_dsa_65: :native_test_sign_keypair_from_seed,
-      ml_dsa_87: :native_test_ml_dsa_87_keypair_from_seed,
+      ml_dsa_87: :native_test_ml_dsa_87_keypair_from_seed
     }.freeze
 
     MLDSA_SIGN_METHODS = {
       ml_dsa_44: :native_test_ml_dsa_44_sign_from_seed,
       ml_dsa_65: :native_test_sign_from_seed,
-      ml_dsa_87: :native_test_ml_dsa_87_sign_from_seed,
+      ml_dsa_87: :native_test_ml_dsa_87_sign_from_seed
     }.freeze
 
     def self.ml_kem_keypair_from_seed(seed, algorithm: :ml_kem_768)

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pq_crypto
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.6.0
 platform: ruby
 authors:
 - Roman Haydarov
+autorequire:
 bindir: exe
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-05-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -314,6 +315,7 @@ files:
 - lib/pq_crypto/errors.rb
 - lib/pq_crypto/hybrid_kem.rb
 - lib/pq_crypto/kem.rb
+- lib/pq_crypto/key.rb
 - lib/pq_crypto/pkcs8.rb
 - lib/pq_crypto/serialization.rb
 - lib/pq_crypto/signature.rb
@@ -328,6 +330,7 @@ metadata:
   homepage_uri: https://github.com/roman-haidarov/pq_crypto
   source_code_uri: https://github.com/roman-haidarov/pq_crypto/tree/main
   changelog_uri: https://github.com/roman-haidarov/pq_crypto/blob/main/CHANGELOG.md
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -335,14 +338,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.4.0
+      version: '3.1'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 3.3.27
+signing_key:
 specification_version: 4
 summary: Primitive-first post-quantum cryptography for Ruby
 test_files: []