Skip to content
NOQTIS

noqtis-keygen(1)

noqtis-keygen — make a signature or KEM key pair

noqtis keygen -a alg -o key [--seed hex | file] [-f | --force]

noqtis keygen makes a key pair for alg, writes the secret key to key (created owner-only, mode 0600) and the public key to key.pub. Both are key files in the format described in noqtis(1). It prints one line naming the algorithm and both files.

alg, --alg=alg
A signature or KEM algorithm, by any name noqtis-algs(1) lists; case does not matter.
key, --out=key
The secret key file; the public key goes to key.pub.
hex | file
Deterministic key generation from the standard's seed, for test vectors and reproducible keys. When a file of that name exists, its raw bytes (1 to 256) are the seed; otherwise the argument must be an even number of hex digits. The seed must have the standard's length: 32 bytes (xi) for ML-DSA; 3n bytes (SK.seed || SK.prf || PK.seed) for SLH-DSA, that is 48, 72 or 96; 64 bytes (d || z) for ML-KEM; 32 bytes for HQC. A seed of another length is a library error (exit 2). Anyone who knows the seed knows the secret key. A seed given as hex digits on the command line can be read by other users (the process list) and is kept in shell history; prefer a seed file with mode 0600. noqtis keygen prints a warning when given one.
, --force
Replace existing files. The old files are removed first.

The secret key is written with mode 0600 and the public key with 0644, whatever the umask: the public key is a trust anchor, and must not be writable by others.

0 on success; 2 on a usage error, an unknown algorithm, a seed of the wrong length, an existing file without --force, or a file that cannot be written.

A signing key:

$ noqtis keygen -a ML-DSA-65 -o me
ML-DSA-65 key pair: me (secret), me.pub (public)
$ head -1 me.pub
noqtis-key-1 ML-DSA-65 pub

A deterministic ML-DSA-44 key from a 32-byte seed:

$ noqtis keygen -a ml-dsa-44 -o det --seed \
    000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
ML-DSA-44 key pair: det (secret), det.pub (public)

A KEM key:

$ noqtis keygen -a ML-KEM-768 -o box
ML-KEM-768 key pair: box (secret), box.pub (public)

noqtis(1), noqtis-algs(1), noqtis-enc(1), noqtis-sign(1), nqenc(3), nqsign(3)