Struct rubedo::crypto::SigningKey

pub struct SigningKey { /* private fields */ }

An ed25519 signing key which can be used to produce signatures.

This is a wrapper around ed25519_dalek::SigningKey, which provides additional functionality, including serialisation and deserialisation using Serde, via the implementation of the ByteSized and ByteSizedFull traits.

See also

• ed25519_dalek::SigningKey

Implementations

impl SigningKey

pub fn generate<R: CryptoRngCore + ?Sized>(csprng: &mut R) -> Self

Generates an ed25519 SigningKey.

This function exists to return the wrapper type SigningKey rather than the inner type ed25519_dalek::SigningKey.

pub fn into_inner(self) -> RealSigningKey

Consumes the SigningKey and returns the inner ed25519_dalek::SigningKey.

pub fn verifying_key(&self) -> VerifyingKey

Returns the VerifyingKey for this SigningKey.

This function exists to return the wrapper type VerifyingKey rather than the inner type ed25519_dalek::VerifyingKey.

Methods from Deref<Target = RealSigningKey>

pub fn to_bytes(&self) -> [u8; 32]

Convert this SigningKey into a SecretKey

pub fn as_bytes(&self) -> &[u8; 32]

Convert this SigningKey into a SecretKey reference

pub fn to_keypair_bytes(&self) -> [u8; 64]

Convert this signing key to a 64-byte keypair.

Returns

An array of bytes, [u8; KEYPAIR_LENGTH]. The first SECRET_KEY_LENGTH of bytes is the SecretKey, and the next PUBLIC_KEY_LENGTH bytes is the VerifyingKey (the same as other libraries, such as Adam Langley’s ed25519 Golang implementation). It is guaranteed that the encoded public key is the one derived from the encoded secret key.

pub fn verifying_key(&self) -> VerifyingKey

Get the VerifyingKey for this SigningKey.

pub fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), Error>

Verify a signature on a message with this signing key’s public key.

pub fn verify_strict( &self, message: &[u8], signature: &Signature ) -> Result<(), Error>

Strictly verify a signature on a message with this signing key’s public key.

On The (Multiple) Sources of Malleability in Ed25519 Signatures

This version of verification is technically non-RFC8032 compliant. The following explains why.

1. Scalar Malleability

The authors of the RFC explicitly stated that verification of an ed25519 signature must fail if the scalar s is not properly reduced mod \ell:

To verify a signature on a message M using public key A, with F being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or Ed25519ph is being used, C being the context, first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A’. If any of the decodings fail (including S being out of range), the signature is invalid.)

All verify_*() functions within ed25519-dalek perform this check.

2. Point malleability

The authors of the RFC added in a malleability check to step #3 in §5.1.7, for small torsion components in the R value of the signature, which is not strictly required, as they state:

Check the group equation [8][S]B = [8]R + [8][k]A’. It’s sufficient, but not required, to instead check [S]B = R + [k]A’.

History of Malleability Checks

As originally defined (cf. the “Malleability” section in the README of this repo), ed25519 signatures didn’t consider any form of malleability to be an issue. Later the scalar malleability was considered important. Still later, particularly with interests in cryptocurrency design and in unique identities (e.g. for Signal users, Tor onion services, etc.), the group element malleability became a concern.

However, libraries had already been created to conform to the original definition. One well-used library in particular even implemented the group element malleability check, but only for batch verification! Which meant that even using the same library, a single signature could verify fine individually, but suddenly, when verifying it with a bunch of other signatures, the whole batch would fail!

“Strict” Verification

This method performs both of the above signature malleability checks.

It must be done as a separate method because one doesn’t simply get to change the definition of a cryptographic primitive ten years after-the-fact with zero consideration for backwards compatibility in hardware and protocols which have it already have the older definition baked in.

Return

Returns Ok(()) if the signature is valid, and Err otherwise.

pub fn to_scalar_bytes(&self) -> [u8; 32]

Convert this signing key into a byte representation of an unreduced, unclamped Curve25519 scalar. This is NOT the same thing as self.to_scalar().to_bytes(), since to_scalar() performs a clamping step, which changes the value of the resulting scalar.

This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The bytes output by this function are a valid corresponding StaticSecret for the X25519 public key given by self.verifying_key().to_montgomery().

Note

We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.

For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.

pub fn to_scalar(&self) -> Scalar

Convert this signing key into a Curve25519 scalar. This is computed by clamping and reducing the output of Self::to_scalar_bytes.

This can be used anywhere where a Curve25519 scalar is used as a private key, e.g., in crypto_box.

Note

We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.

For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.

Trait Implementations

impl AsRef<[u8; 32]> for SigningKey

fn as_ref(&self) -> &[u8; 32]

Converts this type into a shared reference of the (usually inferred) input type.

impl ByteSized<32> for SigningKey

fn as_bytes(&self) -> &[u8; 32]

Returns a byte slice of the container’s contents.

fn to_bytes(&self) -> [u8; 32]

Returns a copy of the container data as a fixed-length array of bytes.

fn from_bytes(bytes: [u8; 32]) -> Self

Constructs a ByteSized type from an array of bytes.

fn to_base64(&self) -> String

Returns the container data converted to a base64-encoded String.

fn from_base64(encoded: &str) -> Result<Self, DecodeError>

Converts a base64-encoded String to a ByteSized type.

fn to_hex(&self) -> String

Returns the container data converted to a hex-encoded String.

fn from_hex(encoded: &str) -> Result<Self, FromHexError>

Converts a hex-encoded String to a ByteSized.

fn to_vec(&self) -> Vec<u8>

Returns a copy of the container data converted to a vector of bytes.

impl Clone for SigningKey

fn clone(&self) -> SigningKey

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SigningKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SigningKey

fn default() -> Self

Returns the “default value” for a type.

impl Deref for SigningKey

type Target = SigningKey

The resulting type after dereferencing.

fn deref(&self) -> &Self::Target

Dereferences the value.

impl<'de> Deserialize<'de> for SigningKey

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialises the signing key from a String.

This method deserialises the signing key from hexadecimal string representation.

See also

• SigningKey::deserialize()
• SigningKey::from_base64()

impl Display for SigningKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the signing key for display.

This method serialises the signing key into hexadecimal string representation.

See also

• SigningKey::serialize()
• SigningKey::to_base64()

impl ForceFrom<&[u8]> for SigningKey

fn force_from(b: &[u8]) -> Self

Converts a &[u8] to a SigningKey.

Note that if the incoming [u8] is too long to fit, it will be truncated without error or warning. If there is not enough data, it will be padded with zeroes. If this situation needs checking, use try_from() instead.

impl<const N: usize> ForceFrom<&[u8; N]> for SigningKey

fn force_from(b: &[u8; N]) -> Self

Converts a &[u8; N] to a SigningKey.

Note that if the incoming [u8; N] is too long to fit, it will be truncated without error or warning. If there is not enough data, it will be padded with zeroes. If this situation needs checking, use try_from() instead.

impl ForceFrom<&Vec<u8>> for SigningKey

fn force_from(v: &Vec<u8>) -> Self

Converts a &Vec[u8] to a SigningKey.

Note that if the incoming Vec<u8> is too long to fit, it will be truncated without error or warning. If there is not enough data, it will be padded with zeroes. If this situation needs checking, use try_from() instead.

impl ForceFrom<Vec<u8>> for SigningKey

fn force_from(v: Vec<u8>) -> Self

Converts a Vec<u8> to a SigningKey.

Note that if the incoming Vec<u8> is too long to fit, it will be truncated without error or warning. If there is not enough data, it will be padded with zeroes. If this situation needs checking, use try_from() instead.

impl From<&[u8; 32]> for SigningKey

fn from(b: &[u8; 32]) -> Self

Converts a &[u8; 32] to a SigningKey.

impl From<&SigningKey> for SigningKey

fn from(key: &RealSigningKey) -> Self

Converts a &ed25519_dalek::SigningKey to a SigningKey.

impl From<[u8; 32]> for SigningKey

fn from(b: [u8; 32]) -> Self

Converts a [u8; 32] to a SigningKey.

impl From<SigningKey> for SigningKey

fn from(key: RealSigningKey) -> Self

Converts a ed25519_dalek::SigningKey to a SigningKey.

impl FromStr for SigningKey

type Err = ByteSizedError

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl Hash for SigningKey

fn hash<H: Hasher>(&self, state: &mut H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for SigningKey

fn eq(&self, other: &SigningKey) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SigningKey

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialises the signing key to a String.

This method serialises the signing key into hexadecimal string representation.

See also

• SigningKey::deserialize()
• SigningKey::<Display>fmt()
• SigningKey::to_base64()

impl TryFrom<&[u8]> for SigningKey

fn try_from(b: &[u8]) -> Result<Self, Self::Error>

Converts a &[u8] to a SigningKey.

type Error = ByteSizedError

The type returned in the event of a conversion error.

impl TryFrom<&String> for SigningKey

fn try_from(s: &String) -> Result<Self, Self::Error>

Converts a &String to a SigningKey.

type Error = ByteSizedError

The type returned in the event of a conversion error.

impl TryFrom<&Vec<u8>> for SigningKey

fn try_from(v: &Vec<u8>) -> Result<Self, Self::Error>

Converts a &Vec[u8] to a SigningKey.

type Error = ByteSizedError

The type returned in the event of a conversion error.

impl TryFrom<&str> for SigningKey

fn try_from(s: &str) -> Result<Self, Self::Error>

Converts a &str to a SigningKey.

type Error = ByteSizedError

The type returned in the event of a conversion error.

impl TryFrom<Box<str>> for SigningKey

fn try_from(s: Box<str>) -> Result<Self, Self::Error>

Converts a boxed string slice to a SigningKey.

type Error = ByteSizedError

The type returned in the event of a conversion error.

impl<'a> TryFrom<Cow<'a, str>> for SigningKey

fn try_from(s: Cow<'a, str>) -> Result<Self, Self::Error>

Converts a clone-on-write string to a SigningKey.

type Error = ByteSizedError

The type returned in the event of a conversion error.

impl TryFrom<String> for SigningKey

fn try_from(s: String) -> Result<Self, Self::Error>

Converts a String to a SigningKey.

type Error = ByteSizedError

The type returned in the event of a conversion error.

impl TryFrom<Vec<u8>> for SigningKey

fn try_from(v: Vec<u8>) -> Result<Self, Self::Error>

Converts a Vec<u8> to a SigningKey.

type Error = ByteSizedError

The type returned in the event of a conversion error.

impl ByteSizedFull<32> for SigningKey

impl Eq for SigningKey

impl StructuralPartialEq for SigningKey