Struct Ed25519VerifyKey 

pub struct Ed25519VerifyKey { /* private fields */ }

A public key with its point already recovered.

Verification needs the public key as a curve point, and decompressing one is a field exponentiation – about two microseconds, against the twenty a verification takes. A key used more than once should not pay that more than once, which is the same reason Ed25519Key exists on the signing side.

The point is stored negated, because the equation verification checks is [S]B + [k](-A) == R, so that is the form every signature wants.

Ed25519::verify builds one of these and throws it away, which is the right thing for a caller with one signature and the wrong thing for a caller with many.

Implementations

impl Ed25519VerifyKey

pub fn from_bytes(public_key: &[u8]) -> Result<Self>

Decompress public_key, rejecting anything not on the curve, not canonically encoded, or of small order.

The last is not in RFC 8032, and is the check verify_strict in ed25519-dalek and libsodium’s verifier also make. A key of order dividing 8 has no secret behind it worth the name: a signature under one can be made without any private key, for many messages at once, and the same signature can verify under several such keys. No key a correct signer derives has small order, so refusing them costs nothing honest.

pub fn as_bytes(&self) -> &[u8; 32]

The key as it was given.

pub fn verify(&self, message: &[u8], signature: &[u8]) -> Result<()>

Verify signature over message.