Struct bamboo_rs_core::PublicKey[][src]

pub struct PublicKey(_, _);
Expand description

An ed25519 public key.

Implementations

Convert this public key to a byte array.

View this public key as a byte array.

Construct a PublicKey from a slice of bytes.

Warning

The caller is responsible for ensuring that the bytes passed into this method actually represent a curve25519_dalek::curve::CompressedEdwardsY and that said compressed point is actually a point on the curve.

Example

use ed25519_dalek::PublicKey;
use ed25519_dalek::PUBLIC_KEY_LENGTH;
use ed25519_dalek::SignatureError;

let public_key_bytes: [u8; PUBLIC_KEY_LENGTH] = [
   215,  90, 152,   1, 130, 177,  10, 183, 213,  75, 254, 211, 201, 100,   7,  58,
    14, 225, 114, 243, 218, 166,  35,  37, 175,   2,  26, 104, 247,   7,   81, 26];

let public_key = PublicKey::from_bytes(&public_key_bytes)?;

Returns

A Result whose okay value is an EdDSA PublicKey or whose error value is an SignatureError describing the error that occurred.

Verify a signature on a prehashed_message using the Ed25519ph algorithm.

Inputs

  • prehashed_message is an instantiated hash digest with 512-bits of output which has had the message to be signed previously fed into its state.
  • context is an optional context string, up to 255 bytes inclusive, which may be used to provide additional domain separation. If not set, this will default to an empty string.
  • signature is a purported Ed25519ph [Signature] on the prehashed_message.

Returns

Returns true if the signature was a valid signature created by this Keypair on the prehashed_message.

Strictly verify a signature on a message with this keypair’s public key.

On The (Multiple) Sources of Malleability in Ed25519 Signatures

This version of verification is technically non-RFC8032 compliant. The following explains why.

  1. Scalar Malleability

The authors of the RFC explicitly stated that verification of an ed25519 signature must fail if the scalar s is not properly reduced mod \ell:

To verify a signature on a message M using public key A, with F being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or Ed25519ph is being used, C being the context, first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A’. If any of the decodings fail (including S being out of range), the signature is invalid.)

All verify_*() functions within ed25519-dalek perform this check.

  1. Point malleability

The authors of the RFC added in a malleability check to step #3 in §5.1.7, for small torsion components in the R value of the signature, which is not strictly required, as they state:

Check the group equation [8][S]B = [8]R + [8][k]A’. It’s sufficient, but not required, to instead check [S]B = R + [k]A’.

History of Malleability Checks

As originally defined (cf. the “Malleability” section in the README of this repo), ed25519 signatures didn’t consider any form of malleability to be an issue. Later the scalar malleability was considered important. Still later, particularly with interests in cryptocurrency design and in unique identities (e.g. for Signal users, Tor onion services, etc.), the group element malleability became a concern.

However, libraries had already been created to conform to the original definition. One well-used library in particular even implemented the group element malleability check, but only for batch verification! Which meant that even using the same library, a single signature could verify fine individually, but suddenly, when verifying it with a bunch of other signatures, the whole batch would fail!

“Strict” Verification

This method performs both of the above signature malleability checks.

It must be done as a separate method because one doesn’t simply get to change the definition of a cryptographic primitive ten years after-the-fact with zero consideration for backwards compatibility in hardware and protocols which have it already have the older definition baked in.

Return

Returns Ok(()) if the signature is valid, and Err otherwise.

Trait Implementations

Performs the conversion.

Returns a copy of the value. Read more

Performs copy-assignment from source. Read more

Formats the value using the given formatter. Read more

Returns the “default value” for a type. Read more

Deserialize this value from the given Serde deserializer. Read more

Derive this public key from its corresponding ExpandedSecretKey.

Derive this public key from its corresponding SecretKey.

This method tests for self and other values to be equal, and is used by ==. Read more

This method tests for !=.

Serialize this value into the given Serde serializer. Read more

Verify a signature on a message with this keypair’s public key.

Return

Returns Ok(()) if the signature is valid, and Err otherwise.

Auto Trait Implementations

Blanket Implementations

Gets the TypeId of self. Read more

Immutably borrows from an owned value. Read more

Mutably borrows from an owned value. Read more

Performs the conversion.

Performs the conversion.

The alignment of pointer.

The type for initializers.

Initializes a with the given initializer. Read more

Dereferences the given pointer. Read more

Mutably dereferences the given pointer. Read more

Drops the object pointed to by the given pointer. Read more

Should always be Self

Encode the hex strict representing self into the result. Lower case letters are used (e.g. f9b4ca) Read more

Encode the hex strict representing self into the result. Upper case letters are used (e.g. F9B4CA) Read more

The resulting type after obtaining ownership.

Creates owned data from borrowed data, usually by cloning. Read more

🔬 This is a nightly-only experimental API. (toowned_clone_into)

recently added

Uses borrowed data to replace owned data, usually by cloning. Read more

The type returned in the event of a conversion error.

Performs the conversion.

The type returned in the event of a conversion error.

Performs the conversion.