Struct Secp256k1PrivateKey 

pub struct Secp256k1PrivateKey { /* private fields */ }

Available on crate feature secp256k1 only.

A Secp256k1 ECDSA private key.

The private key is zeroized when dropped.

Implementations

impl Secp256k1PrivateKey

pub fn generate() -> Self

Generates a new random Secp256k1 private key.

pub fn from_bytes(bytes: &[u8]) -> AptosResult<Self>

Creates a private key from raw bytes.

Errors

Returns AptosError::InvalidPrivateKey if:

• The byte slice length is not exactly 32 bytes
• The bytes do not represent a valid Secp256k1 private key

pub fn from_hex(hex_str: &str) -> AptosResult<Self>

Creates a private key from a hex string.

Errors

Returns AptosError::Hex if the hex string is invalid. Returns AptosError::InvalidPrivateKey if the decoded bytes are not exactly 32 bytes or do not represent a valid Secp256k1 private key.

pub fn from_aip80(s: &str) -> AptosResult<Self>

Creates a private key from AIP-80 format string.

AIP-80 format: secp256k1-priv-0x{hex_bytes}

Errors

Returns an error if the format is invalid or the key bytes are invalid.

pub fn to_bytes(&self) -> [u8; 32]

Returns the private key as bytes.

pub fn to_hex(&self) -> String

Returns the private key as a hex string.

pub fn to_aip80(&self) -> String

Returns the private key in AIP-80 format.

AIP-80 format: secp256k1-priv-0x{hex_bytes}

pub fn public_key(&self) -> Secp256k1PublicKey

Returns the corresponding public key.

pub fn sign(&self, message: &[u8]) -> Secp256k1Signature

Signs message and returns a low-S ECDSA signature over the SHA3-256 digest of message.

Aptos on-chain verification (see aptos-crypto::secp256k1_ecdsa::Signature::verify) hashes the signing-message preimage with SHA-3-256 before invoking ECDSA on the 32-byte digest. We mirror that flow exactly: compute the SHA-3-256 digest first, then sign it via PrehashSigner so the k256 crate does not apply its default SHA-256 internally.

Historical note: prior versions of this SDK relied on Signer::sign which does an internal SHA-256, producing a signature over SHA-256(message) (or, with a SHA-256 pre-hash, over SHA-256(SHA-256(message))). Both forms verified internally but were rejected by the chain because the chain hashes with SHA-3-256.

Panics

Panics only in the (mathematically impossible) case that k256::ecdsa::SigningKey::sign_prehash returns Err for a 32-byte prehash, which the signature::hazmat::PrehashSigner contract for secp256k1 does not produce.

pub fn sign_prehashed(&self, digest: &[u8; 32]) -> Secp256k1Signature

Signs a 32-byte pre-computed digest directly, with NO further hashing.

The caller is responsible for ensuring digest is the correct hash for the on-chain verification scheme (Aptos uses SHA-3-256).

Panics

Panics only if k256::ecdsa::SigningKey::sign_prehash returns Err for the supplied 32-byte digest, which the signature::hazmat::PrehashSigner contract for secp256k1 does not produce.

Trait Implementations

impl Clone for Secp256k1PrivateKey

fn clone(&self) -> Secp256k1PrivateKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Secp256k1PrivateKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Signer for Secp256k1PrivateKey

type Signature = Secp256k1Signature

The signature type produced by this signer.

fn sign(&self, message: &[u8]) -> Secp256k1Signature

Signs the given message and returns a signature.

fn public_key(&self) -> Secp256k1PublicKey

Returns the public key corresponding to this signer.

impl Zeroize for Secp256k1PrivateKey

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.