Struct cosmian_crypto_core::Ed25519PublicKey
source · pub struct Ed25519PublicKey(/* private fields */);
Implementations§
source§impl Ed25519PublicKey
impl Ed25519PublicKey
Facades
Facades are used to hide the underlying types and provide a more user friendly interface to the user.
sourcepub fn to_bytes(&self) -> [u8; 32]
pub fn to_bytes(&self) -> [u8; 32]
Serialize the public key.
Facade to FixedSizeCBytes::to_bytes
.
sourcepub fn try_from_bytes(bytes: [u8; 32]) -> Result<Self, CryptoCoreError>
pub fn try_from_bytes(bytes: [u8; 32]) -> Result<Self, CryptoCoreError>
Deserialize the public key.
Facade to FixedSizeCBytes::try_from_bytes
.
sourcepub fn try_from_slice(slice: &[u8]) -> Result<Self, CryptoCoreError>
pub fn try_from_slice(slice: &[u8]) -> Result<Self, CryptoCoreError>
Tries to create a key from the given slice of bytes into a key.
Facade to FixedSizeCBytes::try_from_slice
.
Methods from Deref<Target = EdPublicKey>§
sourcepub fn is_weak(&self) -> bool
pub fn is_weak(&self) -> bool
Returns whether this is a weak public key, i.e., if this public key has low order.
A weak public key can be used to generate a signature that’s valid for almost every
message. Self::verify_strict
denies weak keys, but if you want to check for this
property before verification, then use this method.
sourcepub fn verify_strict(
&self,
message: &[u8],
signature: &Signature,
) -> Result<(), Error>
pub fn verify_strict( &self, message: &[u8], signature: &Signature, ) -> Result<(), Error>
Strictly verify a signature on a message with this keypair’s public key.
§On The (Multiple) Sources of Malleability in Ed25519 Signatures
This version of verification is technically non-RFC8032 compliant. The following explains why.
- Scalar Malleability
The authors of the RFC explicitly stated that verification of an ed25519
signature must fail if the scalar s
is not properly reduced mod $\ell$:
To verify a signature on a message M using public key A, with F being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or Ed25519ph is being used, C being the context, first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A’. If any of the decodings fail (including S being out of range), the signature is invalid.)
All verify_*()
functions within ed25519-dalek perform this check.
- Point malleability
The authors of the RFC added in a malleability check to step #3 in
§5.1.7, for small torsion components in the R
value of the signature,
which is not strictly required, as they state:
Check the group equation [8][S]B = [8]R + [8][k]A’. It’s sufficient, but not required, to instead check [S]B = R + [k]A’.
§History of Malleability Checks
As originally defined (cf. the “Malleability” section in the README of this repo), ed25519 signatures didn’t consider any form of malleability to be an issue. Later the scalar malleability was considered important. Still later, particularly with interests in cryptocurrency design and in unique identities (e.g. for Signal users, Tor onion services, etc.), the group element malleability became a concern.
However, libraries had already been created to conform to the original definition. One well-used library in particular even implemented the group element malleability check, but only for batch verification! Which meant that even using the same library, a single signature could verify fine individually, but suddenly, when verifying it with a bunch of other signatures, the whole batch would fail!
§“Strict” Verification
This method performs both of the above signature malleability checks.
It must be done as a separate method because one doesn’t simply get to change the definition of a cryptographic primitive ten years after-the-fact with zero consideration for backwards compatibility in hardware and protocols which have it already have the older definition baked in.
§Return
Returns Ok(())
if the signature is valid, and Err
otherwise.
sourcepub fn to_montgomery(&self) -> MontgomeryPoint
pub fn to_montgomery(&self) -> MontgomeryPoint
Convert this verifying key into Montgomery form.
This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The output of
this function is a valid X25519 public key whose secret key is sk.to_scalar_bytes()
,
where sk
is a valid signing key for this VerifyingKey
.
§Note
We do NOT recommend this usage of a signing/verifying key. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.
For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.
Trait Implementations§
source§impl Clone for Ed25519PublicKey
impl Clone for Ed25519PublicKey
source§fn clone(&self) -> Ed25519PublicKey
fn clone(&self) -> Ed25519PublicKey
1.0.0 · source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source
. Read moresource§impl Debug for Ed25519PublicKey
impl Debug for Ed25519PublicKey
source§impl Deref for Ed25519PublicKey
impl Deref for Ed25519PublicKey
source§impl EncodePublicKey for Ed25519PublicKey
impl EncodePublicKey for Ed25519PublicKey
source§fn to_public_key_der(&self) -> Result<Document>
fn to_public_key_der(&self) -> Result<Document>
Document
containing a SPKI-encoded public key.source§fn to_public_key_pem(&self, line_ending: LineEnding) -> Result<String, Error>
fn to_public_key_pem(&self, line_ending: LineEnding) -> Result<String, Error>
LineEnding
.source§fn write_public_key_der_file(&self, path: impl AsRef<Path>) -> Result<(), Error>
fn write_public_key_der_file(&self, path: impl AsRef<Path>) -> Result<(), Error>
source§fn write_public_key_pem_file(
&self,
path: impl AsRef<Path>,
line_ending: LineEnding,
) -> Result<(), Error>
fn write_public_key_pem_file( &self, path: impl AsRef<Path>, line_ending: LineEnding, ) -> Result<(), Error>
source§impl FixedSizeCBytes<{ ED25519_PUBLIC_KEY_LENGTH }> for Ed25519PublicKey
impl FixedSizeCBytes<{ ED25519_PUBLIC_KEY_LENGTH }> for Ed25519PublicKey
source§fn try_from_bytes(bytes: [u8; 32]) -> Result<Self, CryptoCoreError>
fn try_from_bytes(bytes: [u8; 32]) -> Result<Self, CryptoCoreError>
source§fn try_from_slice(slice: &[u8]) -> Result<Self, CryptoCoreError>
fn try_from_slice(slice: &[u8]) -> Result<Self, CryptoCoreError>
source§impl From<&Curve25519Secret> for Ed25519PublicKey
impl From<&Curve25519Secret> for Ed25519PublicKey
source§fn from(sk: &Ed25519PrivateKey) -> Self
fn from(sk: &Ed25519PrivateKey) -> Self
source§impl From<Ed25519PublicKey> for EdPublicKey
impl From<Ed25519PublicKey> for EdPublicKey
source§fn from(val: Ed25519PublicKey) -> Self
fn from(val: Ed25519PublicKey) -> Self
source§impl PartialEq for Ed25519PublicKey
impl PartialEq for Ed25519PublicKey
source§fn eq(&self, other: &Ed25519PublicKey) -> bool
fn eq(&self, other: &Ed25519PublicKey) -> bool
self
and other
values to be equal, and is used
by ==
.source§impl Verifier<Signature> for Ed25519PublicKey
impl Verifier<Signature> for Ed25519PublicKey
Verifier implementation for Ed25519.
impl CBytes for Ed25519PublicKey
impl Eq for Ed25519PublicKey
impl StructuralPartialEq for Ed25519PublicKey
Auto Trait Implementations§
impl Freeze for Ed25519PublicKey
impl RefUnwindSafe for Ed25519PublicKey
impl Send for Ed25519PublicKey
impl Sync for Ed25519PublicKey
impl Unpin for Ed25519PublicKey
impl UnwindSafe for Ed25519PublicKey
Blanket Implementations§
source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
source§impl<T> EncodeRsaPublicKey for Twhere
T: EncodePublicKey,
impl<T> EncodeRsaPublicKey for Twhere
T: EncodePublicKey,
source§fn to_pkcs1_der(&self) -> Result<Document, Error>
fn to_pkcs1_der(&self) -> Result<Document, Error>
Document
containing a PKCS#1-encoded public key.