System.Security.Cryptography.MLDsa

public abstract class MLDsa : IDisposable

Represents an ML-DSA key.

public static bool IsSupported { get; }

Gets a value indicating whether the current platform supports ML-DSA.

public MLDsaAlgorithm Algorithm { get; }

Gets the specific ML-DSA algorithm for this key.

protected MLDsa(MLDsaAlgorithm algorithm)

Initializes a new instance of the MLDsa class.

public static MLDsa GenerateKey(MLDsaAlgorithm algorithm)

Generates a new ML-DSA key.

public static MLDsa ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> passwordBytes, ReadOnlySpan<byte> source)

Imports an ML-DSA private key from a PKCS#8 EncryptedPrivateKeyInfo structure.

public static MLDsa ImportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password, ReadOnlySpan<byte> source)

Imports an ML-DSA private key from a PKCS#8 EncryptedPrivateKeyInfo structure.

public static MLDsa ImportEncryptedPkcs8PrivateKey(string password, byte[] source)

public static MLDsa ImportFromEncryptedPem(ReadOnlySpan<char> source, ReadOnlySpan<char> password)

Imports an ML-DSA key from an encrypted RFC 7468 PEM-encoded string.

public static MLDsa ImportFromEncryptedPem(ReadOnlySpan<char> source, ReadOnlySpan<byte> passwordBytes)

Imports an ML-DSA key from an encrypted RFC 7468 PEM-encoded string.

public static MLDsa ImportFromEncryptedPem(string source, string password)

public static MLDsa ImportFromEncryptedPem(string source, byte[] passwordBytes)

public static MLDsa ImportFromPem(ReadOnlySpan<char> source)

Imports an ML-DSA key from an RFC 7468 PEM-encoded string.

public static MLDsa ImportFromPem(string source)

public static MLDsa ImportMLDsaPrivateKey(MLDsaAlgorithm algorithm, ReadOnlySpan<byte> source)

Imports an ML-DSA private key in the FIPS 204 private key format.

public static MLDsa ImportMLDsaPrivateKey(MLDsaAlgorithm algorithm, byte[] source)

public static MLDsa ImportMLDsaPrivateSeed(MLDsaAlgorithm algorithm, ReadOnlySpan<byte> source)

Imports an ML-DSA private key from its private seed value.

public static MLDsa ImportMLDsaPrivateSeed(MLDsaAlgorithm algorithm, byte[] source)

public static MLDsa ImportMLDsaPublicKey(MLDsaAlgorithm algorithm, ReadOnlySpan<byte> source)

Imports an ML-DSA public key in the FIPS 204 public key format.

public static MLDsa ImportMLDsaPublicKey(MLDsaAlgorithm algorithm, byte[] source)

public static MLDsa ImportPkcs8PrivateKey(ReadOnlySpan<byte> source)

Imports an ML-DSA private key from a PKCS#8 PrivateKeyInfo structure.

public static MLDsa ImportPkcs8PrivateKey(byte[] source)

public static MLDsa ImportSubjectPublicKeyInfo(ReadOnlySpan<byte> source)

Imports an ML-DSA public key from an X.509 SubjectPublicKeyInfo structure.

public static MLDsa ImportSubjectPublicKeyInfo(byte[] source)

public void Dispose()

Releases all resources used by the MLDsa class.

protected virtual void Dispose(bool disposing)

Called by the Dispose() and Finalize() methods to release the managed and unmanaged resources used by the current instance of the MLDsa class.

public byte[] ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters pbeParameters)

Exports the current key in the PKCS#8 EncryptedPrivateKeyInfo format with a char-based password.

public byte[] ExportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> passwordBytes, PbeParameters pbeParameters)

Exports the current key in the PKCS#8 EncryptedPrivateKeyInfo format with a byte-based password.

public byte[] ExportEncryptedPkcs8PrivateKey(string password, PbeParameters pbeParameters)

public string ExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<char> password, PbeParameters pbeParameters)

Exports the current key in a PEM-encoded representation of the PKCS#8 EncryptedPrivateKeyInfo representation of this key, using a char-based password.

public string ExportEncryptedPkcs8PrivateKeyPem(ReadOnlySpan<byte> passwordBytes, PbeParameters pbeParameters)

Exports the current key in a PEM-encoded representation of the PKCS#8 EncryptedPrivateKeyInfo representation of this key, using a byte-based password.

public string ExportEncryptedPkcs8PrivateKeyPem(string password, PbeParameters pbeParameters)

public byte[] ExportMLDsaPrivateKey()

Exports the current key in the FIPS 204 private key format.

public void ExportMLDsaPrivateKey(Span<byte> destination)

Exports the current key in the FIPS 204 private key format.

protected abstract void ExportMLDsaPrivateKeyCore(Span<byte> destination)

When overridden in a derived class, exports the FIPS 204 private key to the specified buffer.

public byte[] ExportMLDsaPrivateSeed()

Exports the private seed in the FIPS 204 private seed format.

public void ExportMLDsaPrivateSeed(Span<byte> destination)

Exports the private seed of the current key.

protected abstract void ExportMLDsaPrivateSeedCore(Span<byte> destination)

When overridden in a derived class, exports the private seed to the specified buffer.

public byte[] ExportMLDsaPublicKey()

Exports the public-key portion of the current key in the FIPS 204 public key format.

public void ExportMLDsaPublicKey(Span<byte> destination)

Exports the public-key portion of the current key in the FIPS 204 public key format.

protected abstract void ExportMLDsaPublicKeyCore(Span<byte> destination)

When overridden in a derived class, exports the FIPS 204 public key to the specified buffer.

public byte[] ExportPkcs8PrivateKey()

Exports the current key in the PKCS#8 PrivateKeyInfo format.

public string ExportPkcs8PrivateKeyPem()

Exports the current key in a PEM-encoded representation of the PKCS#8 PrivateKeyInfo format.

public byte[] ExportSubjectPublicKeyInfo()

Exports the public-key portion of the current key in the X.509 SubjectPublicKeyInfo format.

public string ExportSubjectPublicKeyInfoPem()

Exports the public-key portion of the current key in a PEM-encoded representation of the X.509 SubjectPublicKeyInfo format.

public void SignData(ReadOnlySpan<byte> data, Span<byte> destination, ReadOnlySpan<byte> context = default)

Signs the specified data, writing the signature into the provided buffer.

public byte[] SignData(byte[] data, byte[] context = null)

Signs the specified data.

protected abstract void SignDataCore(ReadOnlySpan<byte> data, ReadOnlySpan<byte> context, Span<byte> destination)

When overridden in a derived class, computes the signature of the specified data and context, writing it into the provided buffer.

public byte[] SignMu(byte[] externalMu)

public byte[] SignMu(ReadOnlySpan<byte> externalMu)

Signs the specified externally computed signature mu (μ) value.

public void SignMu(ReadOnlySpan<byte> externalMu, Span<byte> destination)

Signs the specified externally computed signature mu (μ) value, writing the signature into the provided buffer.

protected abstract void SignMuCore(ReadOnlySpan<byte> externalMu, Span<byte> destination)

When overridden in a derived class, computes the remainder of the signature from the precomputed mu (μ) value, writing it into the provided buffer.

public void SignPreHash(ReadOnlySpan<byte> hash, Span<byte> destination, string hashAlgorithmOid, ReadOnlySpan<byte> context = default)

Signs the specified hash using the FIPS 204 pre-hash signing algorithm, writing the signature into the provided buffer.

public byte[] SignPreHash(byte[] hash, string hashAlgorithmOid, byte[] context = null)

Signs the specified hash using the FIPS 204 pre-hash signing algorithm.

protected abstract void SignPreHashCore(ReadOnlySpan<byte> hash, ReadOnlySpan<byte> context, string hashAlgorithmOid, Span<byte> destination)

When overridden in a derived class, computes the pre-hash signature of the specified hash and context, writing it into the provided buffer.

public bool TryExportEncryptedPkcs8PrivateKey(ReadOnlySpan<char> password, PbeParameters pbeParameters, Span<byte> destination, out int bytesWritten)

Attempts to export the current key in the PKCS#8 EncryptedPrivateKeyInfo format into a provided buffer, using a char-based password.

public bool TryExportEncryptedPkcs8PrivateKey(ReadOnlySpan<byte> passwordBytes, PbeParameters pbeParameters, Span<byte> destination, out int bytesWritten)

Attempts to export the current key in the PKCS#8 EncryptedPrivateKeyInfo format into a provided buffer, using a byte-based password.

public bool TryExportEncryptedPkcs8PrivateKey(string password, PbeParameters pbeParameters, Span<byte> destination, out int bytesWritten)

public bool TryExportPkcs8PrivateKey(Span<byte> destination, out int bytesWritten)

Attempts to export the current key in the PKCS#8 PrivateKeyInfo format into the provided buffer.

protected abstract bool TryExportPkcs8PrivateKeyCore(Span<byte> destination, out int bytesWritten)

When overridden in a derived class, attempts to export the current key in the PKCS#8 PrivateKeyInfo format into the provided buffer.

public bool TryExportSubjectPublicKeyInfo(Span<byte> destination, out int bytesWritten)

Attempts to export the public-key portion of the current key in the X.509 SubjectPublicKeyInfo format into the provided buffer.

public bool VerifyData(ReadOnlySpan<byte> data, ReadOnlySpan<byte> signature, ReadOnlySpan<byte> context = default)

Verifies that the specified signature is valid for this key and the provided data.

public bool VerifyData(byte[] data, byte[] signature, byte[] context = null)

Verifies that the specified signature is valid for this key and the provided data.

protected abstract bool VerifyDataCore(ReadOnlySpan<byte> data, ReadOnlySpan<byte> context, ReadOnlySpan<byte> signature)

When overridden in a derived class, verifies the signature of the specified data and context.

public bool VerifyMu(byte[] externalMu, byte[] signature)

public bool VerifyMu(ReadOnlySpan<byte> externalMu, ReadOnlySpan<byte> signature)

Verifies that a digital signature is valid for the provided externally computed signature mu (μ) value.

protected abstract bool VerifyMuCore(ReadOnlySpan<byte> externalMu, ReadOnlySpan<byte> signature)

When overridden in a derived class, verifies that a digital signature is valid for the provided externally computed signature mu (μ) value.

public bool VerifyPreHash(ReadOnlySpan<byte> hash, ReadOnlySpan<byte> signature, string hashAlgorithmOid, ReadOnlySpan<byte> context = default)

Verifies that the specified FIPS 204 pre-hash signature is valid for this key and the provided hash.

public bool VerifyPreHash(byte[] hash, byte[] signature, string hashAlgorithmOid, byte[] context = null)

Verifies that the specified FIPS 204 pre-hash signature is valid for this key and the provided hash.

protected abstract bool VerifyPreHashCore(ReadOnlySpan<byte> hash, ReadOnlySpan<byte> context, string hashAlgorithmOid, ReadOnlySpan<byte> signature)

When overridden in a derived class, verifies the pre-hash signature of the specified hash and context.