dryoc/

keypair.rs

//! # Public/secret keypair tools
//!
//! Provides an implementation for handling public/private keypairs based on
//! libsodium's crypto_box, which uses X25519.
//!
//! With the `protected` feature, [`KeyPair`] also provides locked-memory
//! constructors such as [`KeyPair::generate_locked_keypair`]; the key types
//! come from [`protected`](crate::protected).

use core::fmt;

#[cfg(feature = "serde")]
use serde::{Deserialize, Serialize};
use zeroize::{Zeroize, ZeroizeOnDrop};

use crate::classic::crypto_box::crypto_box_seed_keypair_inplace;
use crate::constants::{
    CRYPTO_BOX_BEFORENMBYTES, CRYPTO_BOX_PUBLICKEYBYTES, CRYPTO_BOX_SECRETKEYBYTES,
    CRYPTO_BOX_SEEDBYTES,
};
use crate::error::Error;
use crate::precalc::PrecalcSecretKey;
use crate::types::*;
use crate::utils::ct_eq_bytes;

/// Stack-allocated public key type alias.
pub type PublicKey = StackByteArray<CRYPTO_BOX_PUBLICKEYBYTES>;
/// Stack-allocated secret key type alias.
pub type SecretKey = StackByteArray<CRYPTO_BOX_SECRETKEYBYTES>;
/// Stack-allocated key pair type alias.
pub type StackKeyPair = KeyPair<PublicKey, SecretKey>;

#[derive(Zeroize, ZeroizeOnDrop, Clone)]
#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
/// Public/secret keypair for use with [`crate::dryocbox::DryocBox`] and
/// libsodium-compatible public-key encryption.
///
/// Create keypairs with [`KeyPair::generate`], [`KeyPair::from_seed`], or
/// [`KeyPair::from_secret_key`]. There is no `new` or [`Default`]
/// constructor, so an all-zero secret key is never produced implicitly.
pub struct KeyPair<
    PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize,
    SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize,
> {
    /// Public key
    pub public_key: PublicKey,
    /// Secret key
    pub secret_key: SecretKey,
}

impl<
    PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize,
    SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize,
> fmt::Debug for KeyPair<PublicKey, SecretKey>
{
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.debug_struct("KeyPair")
            .field("public_key", &"[REDACTED]")
            .field("secret_key", &"[REDACTED]")
            .finish()
    }
}

impl<
    PublicKey: NewByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize,
    SecretKey: NewByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize,
> KeyPair<PublicKey, SecretKey>
{
    /// Generates a random keypair.
    #[must_use]
    pub fn generate() -> Self {
        use crate::classic::crypto_box::crypto_box_keypair_inplace;

        let mut public_key = PublicKey::new_byte_array();
        let mut secret_key = SecretKey::new_byte_array();
        crypto_box_keypair_inplace(public_key.as_mut_array(), secret_key.as_mut_array());

        Self {
            public_key,
            secret_key,
        }
    }

    /// Derives the public key for `secret_key` and returns the complete
    /// keypair, consuming the secret key.
    #[must_use]
    pub fn from_secret_key(secret_key: SecretKey) -> Self {
        use crate::classic::crypto_core::crypto_scalarmult_base;

        let mut public_key = PublicKey::new_byte_array();
        crypto_scalarmult_base(public_key.as_mut_array(), secret_key.as_array());

        Self {
            public_key,
            secret_key,
        }
    }

    /// Deterministically derives a keypair from `seed`.
    #[must_use]
    pub fn from_seed<Seed: ByteArray<CRYPTO_BOX_SEEDBYTES>>(seed: &Seed) -> Self {
        let mut public_key = PublicKey::new_byte_array();
        let mut secret_key = SecretKey::new_byte_array();

        crypto_box_seed_keypair_inplace(
            public_key.as_mut_array(),
            secret_key.as_mut_array(),
            seed.as_array(),
        );

        Self {
            public_key,
            secret_key,
        }
    }
}

impl<
    'a,
    PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + core::convert::TryFrom<&'a [u8]> + Zeroize,
    SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + core::convert::TryFrom<&'a [u8]> + Zeroize,
> KeyPair<PublicKey, SecretKey>
{
    /// Constructs a new keypair from key slices, consuming them. Does not check
    /// validity or authenticity of keypair.
    ///
    /// # Errors
    ///
    /// Returns an error if either slice does not have the required key length,
    /// or if the target key type rejects the key bytes.
    pub fn from_slices(public_key: &'a [u8], secret_key: &'a [u8]) -> Result<Self, Error> {
        validate_length!(
            exact CRYPTO_BOX_PUBLICKEYBYTES,
            public_key.len(),
            crate::ErrorContext::PublicKey
        );
        validate_length!(
            exact CRYPTO_BOX_SECRETKEYBYTES,
            secret_key.len(),
            crate::ErrorContext::SecretKey
        );

        Ok(Self {
            public_key: PublicKey::try_from(public_key)
                .map_err(|_| Error::invalid_key(crate::ErrorContext::PublicKey))?,
            secret_key: SecretKey::try_from(secret_key)
                .map_err(|_| Error::invalid_key(crate::ErrorContext::SecretKey))?,
        })
    }
}

/// Checks if the given public key is valid according to X25519 rules.
///
/// For X25519 ([`crypto_box`](`crate::classic::crypto_box`),
/// [`DryocBox`](`crate::dryocbox::DryocBox`)), this performs a trial scalar
/// multiplication and rejects public keys that produce an all-zero shared
/// secret, including low-order inputs rejected by libsodium. As required by
/// RFC 7748, the high bit of the encoded public key is ignored.
///
/// Use [`crate::sign::is_valid_public_key`] for Ed25519 signing keys.
///
/// ## Validating Protected Keys
///
/// You can validate keys stored in protected memory directly, as the
/// validation functions operate on references.
///
/// ```
/// # #[cfg(all(feature = "protected", any(unix, windows)))]
/// # {
/// use dryoc::constants::{CRYPTO_BOX_PUBLICKEYBYTES, CRYPTO_BOX_SECRETKEYBYTES};
/// use dryoc::keypair::{KeyPair, is_valid_public_key};
/// use dryoc::protected::{HeapByteArray, LockedRO};
///
/// // Generate a keypair stored in locked, read-only memory
/// let protected_kp: KeyPair<
///     LockedRO<HeapByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>,
///     LockedRO<HeapByteArray<CRYPTO_BOX_SECRETKEYBYTES>>,
/// > = KeyPair::generate_readonly_locked_keypair().expect("Failed to generate locked keypair");
///
/// // Validate the X25519 public key.
/// assert!(
///     is_valid_public_key(&protected_kp.public_key),
///     "Protected X25519 key should be valid"
/// );
/// # }
/// ```
#[must_use]
pub fn is_valid_public_key<PK: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>(key: &PK) -> bool {
    let scalar = [0u8; CRYPTO_BOX_SECRETKEYBYTES];
    let mut shared_secret = [0u8; CRYPTO_BOX_PUBLICKEYBYTES];

    crate::classic::crypto_core::crypto_scalarmult(&mut shared_secret, &scalar, key.as_array())
        .is_ok()
}

impl<
    PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize,
    SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize,
> KeyPair<PublicKey, SecretKey>
{
    /// Computes a stack-allocated shared secret key using a secret key from
    /// this keypair and `third_party_public_key`.
    ///
    /// Compatible with libsodium's `crypto_box_beforenm`.
    ///
    /// # Errors
    ///
    /// Returns an error if `third_party_public_key` is an unacceptable
    /// low-order point.
    #[inline]
    pub fn precalculate<OtherPublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>(
        &self,
        third_party_public_key: &OtherPublicKey,
    ) -> Result<PrecalcSecretKey<StackByteArray<CRYPTO_BOX_BEFORENMBYTES>>, Error> {
        PrecalcSecretKey::precalculate(third_party_public_key, &self.secret_key)
    }
}

#[cfg(any(
    all(feature = "protected", any(unix, windows)),
    all(doc, not(doctest), feature = "std")
))]
#[cfg_attr(all(feature = "nightly", doc), doc(cfg(feature = "protected")))]
mod protected {
    //! Locked-memory constructors and methods for [`KeyPair`].
    use super::*;
    use crate::classic::crypto_box::crypto_box_keypair_inplace;
    use crate::protected::*;

    impl
        KeyPair<
            Locked<HeapByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>,
            Locked<HeapByteArray<CRYPTO_BOX_SECRETKEYBYTES>>,
        >
    {
        /// Returns a new randomly generated locked keypair.
        ///
        /// # Errors
        ///
        /// Returns [`Error::Io`] if either allocation cannot be locked,
        /// commonly because the process has reached its locked-memory limit.
        ///
        /// # Panics
        ///
        /// Panics if either page-aligned allocation cannot be created, its
        /// size cannot be represented with guard pages, or the operating
        /// system's random number generator fails.
        pub fn generate_locked_keypair() -> Result<Self, Error> {
            let mut res = Self {
                public_key: HeapByteArray::<CRYPTO_BOX_PUBLICKEYBYTES>::new_locked()?,
                secret_key: HeapByteArray::<CRYPTO_BOX_SECRETKEYBYTES>::new_locked()?,
            };

            crypto_box_keypair_inplace(
                res.public_key.as_mut_array(),
                res.secret_key.as_mut_array(),
            );

            Ok(res)
        }

        /// Computes a heap-allocated, page-aligned, locked shared secret key
        /// using a secret key from this keypair and
        /// `third_party_public_key`.
        ///
        /// Compatible with libsodium's `crypto_box_beforenm`.
        ///
        /// # Errors
        ///
        /// Returns an error if `third_party_public_key` is an unacceptable
        /// low-order point or the shared-key allocation cannot be locked.
        ///
        /// # Panics
        ///
        /// Panics if the page-aligned shared-key allocation cannot be created
        /// or its size cannot be represented with guard pages.
        #[inline]
        pub fn precalculate_locked<OtherPublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>(
            &self,
            third_party_public_key: &OtherPublicKey,
        ) -> Result<PrecalcSecretKey<Locked<HeapByteArray<CRYPTO_BOX_BEFORENMBYTES>>>, Error>
        {
            PrecalcSecretKey::precalculate_locked(third_party_public_key, &self.secret_key)
        }
    }

    impl
        KeyPair<
            LockedRO<HeapByteArray<CRYPTO_BOX_PUBLICKEYBYTES>>,
            LockedRO<HeapByteArray<CRYPTO_BOX_SECRETKEYBYTES>>,
        >
    {
        /// Returns a new randomly generated locked, read-only keypair.
        ///
        /// # Errors
        ///
        /// Returns [`Error::Io`] if either allocation cannot be locked or its
        /// page permissions cannot be changed to read-only.
        ///
        /// # Panics
        ///
        /// Panics if either page-aligned allocation cannot be created, its
        /// size cannot be represented with guard pages, or the operating
        /// system's random number generator fails.
        pub fn generate_readonly_locked_keypair() -> Result<Self, Error> {
            let mut public_key = HeapByteArray::<CRYPTO_BOX_PUBLICKEYBYTES>::new_locked()?;
            let mut secret_key = HeapByteArray::<CRYPTO_BOX_SECRETKEYBYTES>::new_locked()?;

            crypto_box_keypair_inplace(public_key.as_mut_array(), secret_key.as_mut_array());

            let public_key = public_key.mprotect_readonly()?;
            let secret_key = secret_key.mprotect_readonly()?;

            Ok(Self {
                public_key,
                secret_key,
            })
        }

        /// Computes a heap-allocated, page-aligned, locked, read-only shared
        /// secret key using a secret key from this keypair and
        /// `third_party_public_key`.
        ///
        /// Compatible with libsodium's `crypto_box_beforenm`.
        ///
        /// # Errors
        ///
        /// Returns an error if `third_party_public_key` is an unacceptable
        /// low-order point, the shared-key allocation cannot be locked, or its
        /// page permissions cannot be changed to read-only.
        ///
        /// # Panics
        ///
        /// Panics if the page-aligned shared-key allocation cannot be created
        /// or its size cannot be represented with guard pages.
        #[inline]
        pub fn precalculate_readonly_locked<
            OtherPublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES>,
        >(
            &self,
            third_party_public_key: &OtherPublicKey,
        ) -> Result<PrecalcSecretKey<LockedRO<HeapByteArray<CRYPTO_BOX_BEFORENMBYTES>>>, Error>
        {
            PrecalcSecretKey::precalculate_readonly_locked(third_party_public_key, &self.secret_key)
        }
    }
}

impl<
    PublicKey: ByteArray<CRYPTO_BOX_PUBLICKEYBYTES> + Zeroize,
    SecretKey: ByteArray<CRYPTO_BOX_SECRETKEYBYTES> + Zeroize,
> PartialEq<KeyPair<PublicKey, SecretKey>> for KeyPair<PublicKey, SecretKey>
{
    fn eq(&self, other: &Self) -> bool {
        ct_eq_bytes(self.public_key.as_slice(), other.public_key.as_slice())
            && ct_eq_bytes(self.secret_key.as_slice(), other.secret_key.as_slice())
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn keypair_debug_redacts_keys() {
        let keypair = StackKeyPair::generate();
        let debug = format!("{keypair:?}");

        assert_eq!(
            debug,
            "KeyPair { public_key: \"[REDACTED]\", secret_key: \"[REDACTED]\" }"
        );
    }

    #[test]
    fn test_from_secret_key() {
        let keypair_1 = KeyPair::<
            StackByteArray<CRYPTO_BOX_PUBLICKEYBYTES>,
            StackByteArray<CRYPTO_BOX_SECRETKEYBYTES>,
        >::generate();
        let keypair_2 = KeyPair::from_secret_key(keypair_1.secret_key.clone());

        assert_eq!(keypair_1.public_key, keypair_2.public_key);
    }

    /// `crypto_box_seed_keypair` outputs from libsodium for the all-`0x01` and
    /// all-`0x02` seeds.
    const SEED_KEYPAIRS: [([u8; CRYPTO_BOX_SEEDBYTES], &str, &str); 2] = [
        (
            [1u8; CRYPTO_BOX_SEEDBYTES],
            "1b1b58dd50ea14b60da17b790cd02754d970c9bab864ebb3c0f3016fe51d3f57",
            "5ce86efb75fa4e2c410f46e16de9f6acae1a1703528651b69bc176c088bef3ee",
        ),
        (
            [2u8; CRYPTO_BOX_SEEDBYTES],
            "60346e7c911a5f6ba154129174cafe75b294ac3bbd5549632f48cec6266f8410",
            "aa3c626bc9c38c8c201878ebb1d5b0b50ac40e8986c78793db1d4ef369fca1ce",
        ),
    ];

    /// RFC 7748 section 6.1 / NaCl `tests/box.c` keys and their
    /// `crypto_box_beforenm` shared key.
    const ALICE_SK: &str = "77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a";
    const ALICE_PK: &str = "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a";
    const BOB_SK: &str = "5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb";
    const BOB_PK: &str = "de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f";
    const SHARED_KEY: &str = "1b27556473e985d462cd51197a9a46c76009549eac6474f206c4ee0844f68389";

    fn keypair_from_hex(public_key: &str, secret_key: &str) -> StackKeyPair {
        KeyPair::from_slices(
            &hex::decode(public_key).expect("hex"),
            &hex::decode(secret_key).expect("hex"),
        )
        .expect("keypair")
    }

    #[test]
    fn from_seed_matches_libsodium_and_classic_seed_keypair() {
        for (seed, public_key, secret_key) in SEED_KEYPAIRS {
            let keypair: StackKeyPair = KeyPair::from_seed(&seed);
            assert_eq!(keypair, keypair_from_hex(public_key, secret_key));

            let (classic_pk, classic_sk) =
                crate::classic::crypto_box::crypto_box_seed_keypair(&seed);
            assert_eq!(keypair.public_key.as_array(), &classic_pk);
            assert_eq!(keypair.secret_key.as_array(), &classic_sk);

            assert_eq!(
                KeyPair::from_secret_key(keypair.secret_key.clone()),
                keypair
            );
            assert!(is_valid_public_key(&keypair.public_key));
        }
        assert_ne!(
            StackKeyPair::from_seed(&SEED_KEYPAIRS[0].0),
            StackKeyPair::from_seed(&SEED_KEYPAIRS[1].0)
        );
    }

    #[test]
    fn generated_public_key_is_the_base_point_multiple_of_the_secret_key() {
        use crate::classic::crypto_core::crypto_scalarmult_base;

        let keypair = StackKeyPair::generate();
        let mut public_key = [0u8; CRYPTO_BOX_PUBLICKEYBYTES];
        crypto_scalarmult_base(&mut public_key, keypair.secret_key.as_array());
        assert_eq!(keypair.public_key.as_array(), &public_key);
        assert_eq!(
            KeyPair::from_secret_key(keypair.secret_key.clone()),
            keypair
        );
    }

    #[test]
    fn from_slices_accepts_exact_lengths_and_reports_the_short_side() {
        let alice = keypair_from_hex(ALICE_PK, ALICE_SK);
        assert_eq!(
            alice.public_key.as_slice(),
            hex::decode(ALICE_PK).expect("hex")
        );
        assert_eq!(
            alice.secret_key.as_slice(),
            hex::decode(ALICE_SK).expect("hex")
        );
        assert_eq!(
            StackKeyPair::from_secret_key(alice.secret_key.clone()).public_key,
            alice.public_key
        );

        for len in [
            0,
            CRYPTO_BOX_PUBLICKEYBYTES - 1,
            CRYPTO_BOX_PUBLICKEYBYTES + 1,
        ] {
            assert!(matches!(
                StackKeyPair::from_slices(&vec![0u8; len], alice.secret_key.as_slice()),
                Err(Error::InvalidLength {
                    context: crate::ErrorContext::PublicKey,
                    actual,
                    ..
                }) if actual == len
            ));
        }
        for len in [
            0,
            CRYPTO_BOX_SECRETKEYBYTES - 1,
            CRYPTO_BOX_SECRETKEYBYTES + 1,
        ] {
            assert!(matches!(
                StackKeyPair::from_slices(alice.public_key.as_slice(), &vec![0u8; len]),
                Err(Error::InvalidLength {
                    context: crate::ErrorContext::SecretKey,
                    actual,
                    ..
                }) if actual == len
            ));
        }
    }

    #[test]
    fn precalculate_matches_nacl_shared_key() {
        let alice = keypair_from_hex(ALICE_PK, ALICE_SK);
        let bob = keypair_from_hex(BOB_PK, BOB_SK);
        let expected = hex::decode(SHARED_KEY).expect("hex");

        let from_alice = alice.precalculate(&bob.public_key).expect("precalc");
        let from_bob = bob.precalculate(&alice.public_key).expect("precalc");
        assert_eq!(from_alice.as_slice(), expected.as_slice());
        assert_eq!(from_alice, from_bob);
        assert!(alice.precalculate(&PublicKey::default()).is_err());
    }

    #[cfg(all(feature = "protected", any(unix, windows)))]
    #[test]
    fn locked_precalculate_matches_nacl_shared_key() {
        use crate::protected::*;

        let alice = keypair_from_hex(ALICE_PK, ALICE_SK);
        let bob = keypair_from_hex(BOB_PK, BOB_SK);
        let expected = hex::decode(SHARED_KEY).expect("hex");
        let locked_alice = KeyPair {
            public_key: HeapByteArray::<CRYPTO_BOX_PUBLICKEYBYTES>::from_slice_into_locked(
                alice.public_key.as_slice(),
            )
            .expect("lock pk"),
            secret_key: HeapByteArray::<CRYPTO_BOX_SECRETKEYBYTES>::from_slice_into_locked(
                alice.secret_key.as_slice(),
            )
            .expect("lock sk"),
        };

        let locked = locked_alice
            .precalculate_locked(&bob.public_key)
            .expect("precalc locked");
        assert_eq!(locked.as_slice(), expected.as_slice());
        assert!(
            locked_alice
                .precalculate_locked(&PublicKey::default())
                .is_err()
        );
    }

    #[cfg(all(feature = "serde", feature = "alloc"))]
    #[test]
    fn serde_round_trip_keeps_the_keypair_usable_for_boxes() {
        use crate::dryocbox::{DryocBox, Nonce, VecBox};

        let alice = keypair_from_hex(ALICE_PK, ALICE_SK);
        let bob = keypair_from_hex(BOB_PK, BOB_SK);

        let json = serde_json::to_string(&bob).expect("serialize");
        let decoded: StackKeyPair = serde_json::from_str(&json).expect("deserialize");
        assert_eq!(decoded, bob);

        let nonce = Nonce::from([3u8; crate::constants::CRYPTO_BOX_NONCEBYTES]);
        let dryocbox =
            DryocBox::encrypt_to_vecbox(b"for bob", &nonce, &decoded.public_key, &alice.secret_key)
                .expect("encrypt");
        assert_eq!(
            VecBox::from_bytes(&dryocbox.to_vec())
                .expect("parse")
                .decrypt_to_vec(&nonce, &alice.public_key, &decoded.secret_key)
                .expect("decrypt"),
            b"for bob"
        );

        // Swapping the encoded fields yields a keypair that cannot open the
        // box.
        let swapped = json
            .replacen("public_key", "tmp", 1)
            .replacen("secret_key", "public_key", 1)
            .replacen("tmp", "secret_key", 1);
        let swapped: StackKeyPair = serde_json::from_str(&swapped).expect("deserialize");
        assert_ne!(swapped, bob);
        assert!(
            dryocbox
                .decrypt_to_vec(&nonce, &alice.public_key, &swapped.secret_key)
                .is_err()
        );
    }

    #[test]
    fn test_is_valid_public_key() {
        // Known valid key (assuming it meets X25519 criteria)
        // This specific key is also a valid Ed25519 key.
        let valid_pk_bytes = [
            215, 90, 152, 1, 130, 177, 10, 183, 213, 75, 254, 211, 201, 100, 7, 58, 14, 225, 114,
            243, 218, 166, 35, 37, 175, 2, 26, 104, 247, 7, 81, 26,
        ];
        let valid_pk = PublicKey::from(valid_pk_bytes);
        assert!(
            is_valid_public_key(&valid_pk),
            "Known valid key failed validation"
        );

        // RFC 7748 requires the high bit to be ignored when decoding X25519
        // public keys.
        let mut high_bit_bytes = [0u8; CRYPTO_BOX_PUBLICKEYBYTES];
        high_bit_bytes[0] = 9;
        high_bit_bytes[31] = 0x80;
        let high_bit = PublicKey::from(high_bit_bytes);
        assert!(
            is_valid_public_key(&high_bit),
            "RFC 7748 high-bit encoding should be accepted"
        );

        // Invalid: Zero point
        let zero_bytes = [0u8; CRYPTO_BOX_PUBLICKEYBYTES];
        let zero_pk = PublicKey::from(zero_bytes);
        assert!(!is_valid_public_key(&zero_pk), "Zero key should be invalid");

        let mut identity_bytes = [0u8; CRYPTO_BOX_PUBLICKEYBYTES];
        identity_bytes[0] = 1;
        let identity = PublicKey::from(identity_bytes);
        assert!(
            !is_valid_public_key(&identity),
            "Low-order key should be invalid"
        );

        // Generated key should be valid
        let kp = StackKeyPair::generate();
        assert!(
            is_valid_public_key(&kp.public_key),
            "Generated key failed validation"
        );
    }

    #[cfg(dryoc_native_tests)]
    mod native_tests {
        use super::*;

        #[test]
        fn test_gen_keypair() {
            use crate::classic::crypto_core::crypto_scalarmult_base;
            use crate::native_test_util::scalarmult_curve25519_base;

            let keypair = KeyPair::<
                StackByteArray<CRYPTO_BOX_PUBLICKEYBYTES>,
                StackByteArray<CRYPTO_BOX_SECRETKEYBYTES>,
            >::generate();

            let mut public_key = [0u8; CRYPTO_BOX_PUBLICKEYBYTES];
            crypto_scalarmult_base(&mut public_key, keypair.secret_key.as_array());

            assert_eq!(keypair.public_key.as_array(), &public_key);

            let ge = scalarmult_curve25519_base(&keypair.secret_key);

            assert_eq!(ge, public_key);
        }
    }
}