Struct hypercore::SigningKey
source · pub struct SigningKey { /* private fields */ }
Expand description
ed25519 signing key which can be used to produce signatures.
Implementations§
source§impl SigningKey
impl SigningKey
§Example
use ed25519_dalek::SigningKey;
use ed25519_dalek::SECRET_KEY_LENGTH;
use ed25519_dalek::SignatureError;
let secret_key_bytes: [u8; SECRET_KEY_LENGTH] = [
157, 097, 177, 157, 239, 253, 090, 096,
186, 132, 074, 244, 146, 236, 044, 196,
068, 073, 197, 105, 123, 050, 105, 025,
112, 059, 172, 003, 028, 174, 127, 096, ];
let signing_key: SigningKey = SigningKey::from_bytes(&secret_key_bytes);
assert_eq!(signing_key.to_bytes(), secret_key_bytes);
sourcepub fn from_bytes(secret_key: &[u8; 32]) -> SigningKey
pub fn from_bytes(secret_key: &[u8; 32]) -> SigningKey
Construct a SigningKey
from a SecretKey
sourcepub fn from_keypair_bytes(bytes: &[u8; 64]) -> Result<SigningKey, Error>
pub fn from_keypair_bytes(bytes: &[u8; 64]) -> Result<SigningKey, Error>
Construct a SigningKey
from the bytes of a VerifyingKey
and SecretKey
.
§Inputs
bytes
: an&[u8]
of lengthKEYPAIR_LENGTH
, representing the scalar for the secret key, and a compressed Edwards-Y coordinate of a point on curve25519, both as bytes. (As obtained fromSigningKey::to_bytes
.)
§Returns
A Result
whose okay value is an EdDSA SigningKey
or whose error value
is an SignatureError
describing the error that occurred.
sourcepub fn to_keypair_bytes(&self) -> [u8; 64]
pub fn to_keypair_bytes(&self) -> [u8; 64]
Convert this signing key to a 64-byte keypair.
§Returns
An array of bytes, [u8; KEYPAIR_LENGTH]
. The first
SECRET_KEY_LENGTH
of bytes is the SecretKey
, and the next
PUBLIC_KEY_LENGTH
bytes is the VerifyingKey
(the same as other
libraries, such as Adam Langley’s ed25519 Golang
implementation). It is guaranteed that
the encoded public key is the one derived from the encoded secret key.
sourcepub fn verifying_key(&self) -> VerifyingKey
pub fn verifying_key(&self) -> VerifyingKey
Get the VerifyingKey
for this SigningKey
.
sourcepub fn generate<R>(csprng: &mut R) -> SigningKeywhere
R: CryptoRngCore + ?Sized,
pub fn generate<R>(csprng: &mut R) -> SigningKeywhere
R: CryptoRngCore + ?Sized,
Generate an ed25519 signing key.
§Example
use rand::rngs::OsRng;
use ed25519_dalek::{Signature, SigningKey};
let mut csprng = OsRng;
let signing_key: SigningKey = SigningKey::generate(&mut csprng);
§Input
A CSPRNG with a fill_bytes()
method, e.g. rand_os::OsRng
.
The caller must also supply a hash function which implements the
Digest
and Default
traits, and which returns 512 bits of output.
The standard hash function used for most ed25519 libraries is SHA-512,
which is available with use sha2::Sha512
as in the example above.
Other suitable hash functions include Keccak-512 and Blake2b-512.
sourcepub fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), Error>
pub fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), Error>
Verify a signature on a message with this signing key’s public key.
sourcepub fn verify_strict(
&self,
message: &[u8],
signature: &Signature,
) -> Result<(), Error>
pub fn verify_strict( &self, message: &[u8], signature: &Signature, ) -> Result<(), Error>
Strictly verify a signature on a message with this signing key’s public key.
§On The (Multiple) Sources of Malleability in Ed25519 Signatures
This version of verification is technically non-RFC8032 compliant. The following explains why.
- Scalar Malleability
The authors of the RFC explicitly stated that verification of an ed25519
signature must fail if the scalar s
is not properly reduced mod \ell:
To verify a signature on a message M using public key A, with F being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or Ed25519ph is being used, C being the context, first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A’. If any of the decodings fail (including S being out of range), the signature is invalid.)
All verify_*()
functions within ed25519-dalek perform this check.
- Point malleability
The authors of the RFC added in a malleability check to step #3 in
§5.1.7, for small torsion components in the R
value of the signature,
which is not strictly required, as they state:
Check the group equation [8][S]B = [8]R + [8][k]A’. It’s sufficient, but not required, to instead check [S]B = R + [k]A’.
§History of Malleability Checks
As originally defined (cf. the “Malleability” section in the README of this repo), ed25519 signatures didn’t consider any form of malleability to be an issue. Later the scalar malleability was considered important. Still later, particularly with interests in cryptocurrency design and in unique identities (e.g. for Signal users, Tor onion services, etc.), the group element malleability became a concern.
However, libraries had already been created to conform to the original definition. One well-used library in particular even implemented the group element malleability check, but only for batch verification! Which meant that even using the same library, a single signature could verify fine individually, but suddenly, when verifying it with a bunch of other signatures, the whole batch would fail!
§“Strict” Verification
This method performs both of the above signature malleability checks.
It must be done as a separate method because one doesn’t simply get to change the definition of a cryptographic primitive ten years after-the-fact with zero consideration for backwards compatibility in hardware and protocols which have it already have the older definition baked in.
§Return
Returns Ok(())
if the signature is valid, and Err
otherwise.
sourcepub fn to_scalar_bytes(&self) -> [u8; 32]
pub fn to_scalar_bytes(&self) -> [u8; 32]
Convert this signing key into a byte representation of an unreduced, unclamped Curve25519
scalar. This is NOT the same thing as self.to_scalar().to_bytes()
, since to_scalar()
performs a clamping step, which changes the value of the resulting scalar.
This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The bytes output
by this function are a valid corresponding StaticSecret
for the X25519 public key given by self.verifying_key().to_montgomery()
.
§Note
We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.
For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.
sourcepub fn to_scalar(&self) -> Scalar
pub fn to_scalar(&self) -> Scalar
Convert this signing key into a Curve25519 scalar. This is computed by clamping and
reducing the output of Self::to_scalar_bytes
.
This can be used anywhere where a Curve25519 scalar is used as a private key, e.g., in
crypto_box
.
§Note
We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.
For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.
Trait Implementations§
source§impl AsRef<VerifyingKey> for SigningKey
impl AsRef<VerifyingKey> for SigningKey
source§fn as_ref(&self) -> &VerifyingKey
fn as_ref(&self) -> &VerifyingKey
source§impl Clone for SigningKey
impl Clone for SigningKey
source§fn clone(&self) -> SigningKey
fn clone(&self) -> SigningKey
1.0.0 · source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source
. Read moresource§impl ConstantTimeEq for SigningKey
impl ConstantTimeEq for SigningKey
source§impl Debug for SigningKey
impl Debug for SigningKey
source§impl Drop for SigningKey
impl Drop for SigningKey
source§impl From<&SigningKey> for VerifyingKey
impl From<&SigningKey> for VerifyingKey
source§fn from(signing_key: &SigningKey) -> VerifyingKey
fn from(signing_key: &SigningKey) -> VerifyingKey
source§impl KeypairRef for SigningKey
impl KeypairRef for SigningKey
§type VerifyingKey = VerifyingKey
type VerifyingKey = VerifyingKey
source§impl PartialEq for SigningKey
impl PartialEq for SigningKey
source§fn eq(&self, other: &SigningKey) -> bool
fn eq(&self, other: &SigningKey) -> bool
self
and other
values to be equal, and is used
by ==
.source§impl Signer<Signature> for SigningKey
impl Signer<Signature> for SigningKey
source§impl TryFrom<&[u8]> for SigningKey
impl TryFrom<&[u8]> for SigningKey
source§impl Verifier<Signature> for SigningKey
impl Verifier<Signature> for SigningKey
impl Eq for SigningKey
impl ZeroizeOnDrop for SigningKey
Auto Trait Implementations§
impl Freeze for SigningKey
impl RefUnwindSafe for SigningKey
impl Send for SigningKey
impl Sync for SigningKey
impl Unpin for SigningKey
impl UnwindSafe for SigningKey
Blanket Implementations§
source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
source§default unsafe fn clone_to_uninit(&self, dst: *mut T)
default unsafe fn clone_to_uninit(&self, dst: *mut T)
clone_to_uninit
)