A lot

crypto/Cargo.toml

@@ -20,7 +20,9 @@ ml-dsa = { version = "0.1.1", optional = true }
 serde = { version = "1", optional = true, features = ["derive"] }
 
 [features]
-default = ["chacha20poly1305", "ed25519-dalek", "hkdf", "sha2"]
+default = ["chacha20poly1305", "ed25519-dalek", "hkdf", "sha2", "ml-dsa"]
+# Enabling ml-dsa by default ensures dual-signature support in the handshake
+# without requiring a separate PQC feature flag in host/client crates.
 full = ["default", "aes-gcm"]
 pqc = ["mlkem-tls", "ml-dsa"]
 serde = ["dep:serde"]

crypto/src/keypair.rs

@@ -84,32 +84,6 @@ impl From<Vec<u8>> for SignaturePublicKey {
     }
 }
 
-#[derive(ZeroizeOnDrop)]
-pub struct KeyGroup {
-    #[zeroize(skip)]
-    pub encryption_public_key: EncryptionPublicKey,
-    pub encryption_private_key: EncryptionPrivateKey,
-    #[zeroize(skip)]
-    pub signature_public_key: SignaturePublicKey,
-    pub signature_private_key: SignaturePrivateKey,
-}
-
-impl KeyGroup {
-    pub fn new(
-        encryption_public_key: EncryptionPublicKey,
-        encryption_private_key: EncryptionPrivateKey,
-        signature_public_key: SignaturePublicKey,
-        signature_private_key: SignaturePrivateKey,
-    ) -> Self {
-        Self {
-            encryption_public_key,
-            encryption_private_key,
-            signature_public_key,
-            signature_private_key,
-        }
-    }
-}
-
 #[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
 #[cfg_attr(feature = "serde", serde(transparent))]
 #[derive(Zeroize, ZeroizeOnDrop)]

crypto/src/lib.rs

@@ -11,6 +11,9 @@ pub mod kdf;
 #[cfg(any(feature = "ed25519-dalek", feature = "ml-dsa"))]
 pub mod sign;
 
+#[cfg(any(feature = "ed25519-dalek", feature = "ml-dsa"))]
+pub use sign::SigAlgorithm;
+
 #[cfg(feature = "mlkem-tls")]
 pub mod kem;
 
@@ -19,7 +22,7 @@ pub mod helper;
 pub use aead::{AeadCipher, AeadDecrypt, AeadEncrypt};
 pub use error::CryptoError;
 pub use keypair::{
-    EncryptionPrivateKey, EncryptionPublicKey, KemPrivateKey, KemPublicKey, KeyGroup, Keyring,
+    EncryptionPrivateKey, EncryptionPublicKey, KemPrivateKey, KemPublicKey, Keyring,
     PublicKeyBundle, SignaturePqPrivateKey, SignaturePqPublicKey, SignaturePrivateKey,
     SignaturePublicKey,
 };

crypto/src/sign.rs

@@ -3,6 +3,24 @@ use crate::error::CryptoError;
 #[cfg(feature = "ed25519-dalek")]
 use crate::keypair::{SignaturePrivateKey, SignaturePublicKey};
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SigAlgorithm;
+
+impl SigAlgorithm {
+    pub const ED25519: u8 = 0x01;
+    pub const ML_DSA_65: u8 = 0x02;
+    pub const DUAL: u8 = 0x03;
+
+    pub const fn length(alg: u8) -> Option<usize> {
+        match alg {
+            Self::ED25519 => Some(64),
+            Self::ML_DSA_65 => Some(3309),
+            Self::DUAL => Some(3373),
+            _ => None,
+        }
+    }
+}
+
 #[cfg(feature = "ed25519-dalek")]
 use rand_core::RngCore;