pub struct Signer { /* private fields */ }Expand description
Solana transaction signer.
Wraps an ed25519_dalek::SigningKey with Deref for full upstream
access. The inner key implements ZeroizeOnDrop.
§Examples
use signer_svm::Signer;
use ed25519_dalek::Signer as _;
let signer = Signer::random();
let sig = signer.sign(b"hello solana");
signer.verify(b"hello solana", &sig).unwrap();Implementations§
Source§impl Signer
impl Signer
Sourcepub fn from_bytes(bytes: &[u8; 32]) -> Self
pub fn from_bytes(bytes: &[u8; 32]) -> Self
Create a signer from raw 32-byte secret key bytes.
Sourcepub fn from_hex(hex_str: &str) -> Result<Self, Error>
pub fn from_hex(hex_str: &str) -> Result<Self, Error>
Create a signer from a hex-encoded 32-byte private key.
Accepts keys with or without 0x prefix.
§Errors
Returns an error if the hex string is invalid or the key length is wrong.
Sourcepub fn from_keypair_base58(b58: &str) -> Result<Self, Error>
pub fn from_keypair_base58(b58: &str) -> Result<Self, Error>
Create a signer from a Base58-encoded keypair (64 bytes: secret ‖ public).
This is the standard format used by Phantom, Backpack, and Solflare.
§Errors
Returns an error if the Base58 string is invalid or not 64 bytes.
Sourcepub fn verify(&self, msg: &[u8], signature: &Signature) -> Result<(), Error>
pub fn verify(&self, msg: &[u8], signature: &Signature) -> Result<(), Error>
Verify an Ed25519 signature against this signer’s public key.
§Errors
Returns an error if the signature is invalid.
Sourcepub fn sign_transaction_message(&self, message_bytes: &[u8]) -> Signature
pub fn sign_transaction_message(&self, message_bytes: &[u8]) -> Signature
Sign serialized Solana transaction message bytes.
A Solana transaction signature is an Ed25519 signature over the
serialized message. Use this with any serialization method
(e.g. solana-sdk, solana-transaction).
Sourcepub fn public_key_hex(&self) -> String
pub fn public_key_hex(&self) -> String
Get the public key in hex format.
Sourcepub fn keypair_base58(&self) -> Zeroizing<String>
pub fn keypair_base58(&self) -> Zeroizing<String>
Export the keypair as Base58 (64 bytes: secret ‖ public).
Compatible with Phantom, Backpack, and Solflare wallet format.
Methods from Deref<Target = SigningKey>§
Sourcepub fn to_keypair_bytes(&self) -> [u8; 64]
pub fn to_keypair_bytes(&self) -> [u8; 64]
Convert this signing key to a 64-byte keypair.
§Returns
An array of bytes, [u8; KEYPAIR_LENGTH]. The first
SECRET_KEY_LENGTH of bytes is the SecretKey, and the next
PUBLIC_KEY_LENGTH bytes is the VerifyingKey (the same as other
libraries, such as Adam Langley’s ed25519 Golang
implementation). It is guaranteed that
the encoded public key is the one derived from the encoded secret key.
Sourcepub fn verifying_key(&self) -> VerifyingKey
pub fn verifying_key(&self) -> VerifyingKey
Get the VerifyingKey for this SigningKey.
Sourcepub fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), Error>
pub fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), Error>
Verify a signature on a message with this signing key’s public key.
Sourcepub fn verify_strict(
&self,
message: &[u8],
signature: &Signature,
) -> Result<(), Error>
pub fn verify_strict( &self, message: &[u8], signature: &Signature, ) -> Result<(), Error>
Strictly verify a signature on a message with this signing key’s public key.
§On The (Multiple) Sources of Malleability in Ed25519 Signatures
This version of verification is technically non-RFC8032 compliant. The following explains why.
- Scalar Malleability
The authors of the RFC explicitly stated that verification of an ed25519
signature must fail if the scalar s is not properly reduced mod \ell:
To verify a signature on a message M using public key A, with F being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or Ed25519ph is being used, C being the context, first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A’. If any of the decodings fail (including S being out of range), the signature is invalid.)
All verify_*() functions within ed25519-dalek perform this check.
- Point malleability
The authors of the RFC added in a malleability check to step #3 in
§5.1.7, for small torsion components in the R value of the signature,
which is not strictly required, as they state:
Check the group equation [8][S]B = [8]R + [8][k]A’. It’s sufficient, but not required, to instead check [S]B = R + [k]A’.
§History of Malleability Checks
As originally defined (cf. the “Malleability” section in the README of this repo), ed25519 signatures didn’t consider any form of malleability to be an issue. Later the scalar malleability was considered important. Still later, particularly with interests in cryptocurrency design and in unique identities (e.g. for Signal users, Tor onion services, etc.), the group element malleability became a concern.
However, libraries had already been created to conform to the original definition. One well-used library in particular even implemented the group element malleability check, but only for batch verification! Which meant that even using the same library, a single signature could verify fine individually, but suddenly, when verifying it with a bunch of other signatures, the whole batch would fail!
§“Strict” Verification
This method performs both of the above signature malleability checks.
It must be done as a separate method because one doesn’t simply get to change the definition of a cryptographic primitive ten years after-the-fact with zero consideration for backwards compatibility in hardware and protocols which have it already have the older definition baked in.
§Return
Returns Ok(()) if the signature is valid, and Err otherwise.
Sourcepub fn to_scalar_bytes(&self) -> [u8; 32]
pub fn to_scalar_bytes(&self) -> [u8; 32]
Convert this signing key into a byte representation of an unreduced, unclamped Curve25519
scalar. This is NOT the same thing as self.to_scalar().to_bytes(), since to_scalar()
performs a clamping step, which changes the value of the resulting scalar.
This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The bytes output
by this function are a valid corresponding StaticSecret
for the X25519 public key given by self.verifying_key().to_montgomery().
§Note
We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.
For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.
Sourcepub fn to_scalar(&self) -> Scalar
pub fn to_scalar(&self) -> Scalar
Convert this signing key into a Curve25519 scalar. This is computed by clamping and
reducing the output of Self::to_scalar_bytes.
This can be used anywhere where a Curve25519 scalar is used as a private key, e.g., in
crypto_box.
§Note
We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.
For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.