Struct ed25519_dalek::VerifyingKey
source · pub struct VerifyingKey { /* private fields */ }
Expand description
An ed25519 public key.
§Note
The Eq
and Hash
impls here use the compressed Edwards y encoding, not the algebraic
representation. This means if this VerifyingKey
is non-canonically encoded, it will be
considered unequal to the other equivalent encoding, despite the two representing the same
point. More encoding details can be found
here.
If you want to make sure that signatures produced with respect to those sorts of public keys
are rejected, use VerifyingKey::verify_strict
.
Implementations§
source§impl VerifyingKey
impl VerifyingKey
sourcepub fn from_bytes(bytes: &[u8; 32]) -> Result<VerifyingKey, SignatureError>
pub fn from_bytes(bytes: &[u8; 32]) -> Result<VerifyingKey, SignatureError>
Construct a VerifyingKey
from a slice of bytes.
§Warning
The caller is responsible for ensuring that the bytes passed into this
method actually represent a curve25519_dalek::curve::CompressedEdwardsY
and that said compressed point is actually a point on the curve.
§Example
use ed25519_dalek::VerifyingKey;
use ed25519_dalek::PUBLIC_KEY_LENGTH;
use ed25519_dalek::SignatureError;
let public_key_bytes: [u8; PUBLIC_KEY_LENGTH] = [
215, 90, 152, 1, 130, 177, 10, 183, 213, 75, 254, 211, 201, 100, 7, 58,
14, 225, 114, 243, 218, 166, 35, 37, 175, 2, 26, 104, 247, 7, 81, 26];
let public_key = VerifyingKey::from_bytes(&public_key_bytes)?;
§Returns
A Result
whose okay value is an EdDSA VerifyingKey
or whose error value
is a SignatureError
describing the error that occurred.
sourcepub fn with_context<'k, 'v>(
&'k self,
context_value: &'v [u8]
) -> Result<Context<'k, 'v, Self>, SignatureError>
Available on crate feature digest
only.
pub fn with_context<'k, 'v>( &'k self, context_value: &'v [u8] ) -> Result<Context<'k, 'v, Self>, SignatureError>
digest
only.Create a verifying context that can be used for Ed25519ph with
DigestVerifier
.
sourcepub fn is_weak(&self) -> bool
pub fn is_weak(&self) -> bool
Returns whether this is a weak public key, i.e., if this public key has low order.
A weak public key can be used to generate a signature that’s valid for almost every
message. Self::verify_strict
denies weak keys, but if you want to check for this
property before verification, then use this method.
sourcepub fn verify_prehashed<MsgDigest>(
&self,
prehashed_message: MsgDigest,
context: Option<&[u8]>,
signature: &Signature
) -> Result<(), SignatureError>
Available on crate feature digest
only.
pub fn verify_prehashed<MsgDigest>( &self, prehashed_message: MsgDigest, context: Option<&[u8]>, signature: &Signature ) -> Result<(), SignatureError>
digest
only.Verify a signature
on a prehashed_message
using the Ed25519ph algorithm.
§Inputs
prehashed_message
is an instantiated hash digest with 512-bits of output which has had the message to be signed previously fed into its state.context
is an optional context string, up to 255 bytes inclusive, which may be used to provide additional domain separation. If not set, this will default to an empty string.signature
is a purported Ed25519ph signature on theprehashed_message
.
§Returns
Returns true
if the signature
was a valid signature created by this
SigningKey
on the prehashed_message
.
§Note
The RFC only permits SHA-512 to be used for prehashing, i.e., MsgDigest = Sha512
. This
function technically works, and is probably safe to use, with any secure hash function with
512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose
crate::Sha512
for user convenience.
sourcepub fn verify_strict(
&self,
message: &[u8],
signature: &Signature
) -> Result<(), SignatureError>
pub fn verify_strict( &self, message: &[u8], signature: &Signature ) -> Result<(), SignatureError>
Strictly verify a signature on a message with this keypair’s public key.
§On The (Multiple) Sources of Malleability in Ed25519 Signatures
This version of verification is technically non-RFC8032 compliant. The following explains why.
- Scalar Malleability
The authors of the RFC explicitly stated that verification of an ed25519
signature must fail if the scalar s
is not properly reduced mod $\ell$:
To verify a signature on a message M using public key A, with F being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or Ed25519ph is being used, C being the context, first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A’. If any of the decodings fail (including S being out of range), the signature is invalid.)
All verify_*()
functions within ed25519-dalek perform this check.
- Point malleability
The authors of the RFC added in a malleability check to step #3 in
§5.1.7, for small torsion components in the R
value of the signature,
which is not strictly required, as they state:
Check the group equation [8][S]B = [8]R + [8][k]A’. It’s sufficient, but not required, to instead check [S]B = R + [k]A’.
§History of Malleability Checks
As originally defined (cf. the “Malleability” section in the README of this repo), ed25519 signatures didn’t consider any form of malleability to be an issue. Later the scalar malleability was considered important. Still later, particularly with interests in cryptocurrency design and in unique identities (e.g. for Signal users, Tor onion services, etc.), the group element malleability became a concern.
However, libraries had already been created to conform to the original definition. One well-used library in particular even implemented the group element malleability check, but only for batch verification! Which meant that even using the same library, a single signature could verify fine individually, but suddenly, when verifying it with a bunch of other signatures, the whole batch would fail!
§“Strict” Verification
This method performs both of the above signature malleability checks.
It must be done as a separate method because one doesn’t simply get to change the definition of a cryptographic primitive ten years after-the-fact with zero consideration for backwards compatibility in hardware and protocols which have it already have the older definition baked in.
§Return
Returns Ok(())
if the signature is valid, and Err
otherwise.
sourcepub fn verify_prehashed_strict<MsgDigest>(
&self,
prehashed_message: MsgDigest,
context: Option<&[u8]>,
signature: &Signature
) -> Result<(), SignatureError>
Available on crate feature digest
only.
pub fn verify_prehashed_strict<MsgDigest>( &self, prehashed_message: MsgDigest, context: Option<&[u8]>, signature: &Signature ) -> Result<(), SignatureError>
digest
only.Verify a signature
on a prehashed_message
using the Ed25519ph algorithm,
using strict signture checking as defined by Self::verify_strict
.
§Inputs
prehashed_message
is an instantiated hash digest with 512-bits of output which has had the message to be signed previously fed into its state.context
is an optional context string, up to 255 bytes inclusive, which may be used to provide additional domain separation. If not set, this will default to an empty string.signature
is a purported Ed25519ph signature on theprehashed_message
.
§Returns
Returns true
if the signature
was a valid signature created by this
SigningKey
on the prehashed_message
.
§Note
The RFC only permits SHA-512 to be used for prehashing, i.e., MsgDigest = Sha512
. This
function technically works, and is probably safe to use, with any secure hash function with
512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose
crate::Sha512
for user convenience.
sourcepub fn to_montgomery(&self) -> MontgomeryPoint
pub fn to_montgomery(&self) -> MontgomeryPoint
Convert this verifying key into Montgomery form.
This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The output of
this function is a valid X25519 public key whose secret key is sk.to_scalar_bytes()
,
where sk
is a valid signing key for this VerifyingKey
.
§Note
We do NOT recommend this usage of a signing/verifying key. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.
For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.
Trait Implementations§
source§impl AsRef<[u8]> for VerifyingKey
impl AsRef<[u8]> for VerifyingKey
source§impl AsRef<VerifyingKey> for SigningKey
impl AsRef<VerifyingKey> for SigningKey
source§fn as_ref(&self) -> &VerifyingKey
fn as_ref(&self) -> &VerifyingKey
source§impl Clone for VerifyingKey
impl Clone for VerifyingKey
source§fn clone(&self) -> VerifyingKey
fn clone(&self) -> VerifyingKey
1.0.0 · source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source
. Read moresource§impl Debug for VerifyingKey
impl Debug for VerifyingKey
source§impl Default for VerifyingKey
impl Default for VerifyingKey
source§fn default() -> VerifyingKey
fn default() -> VerifyingKey
source§impl<'d> Deserialize<'d> for VerifyingKey
Available on crate feature serde
only.
impl<'d> Deserialize<'d> for VerifyingKey
serde
only.source§fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>where
D: Deserializer<'d>,
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>where
D: Deserializer<'d>,
source§impl<MsgDigest> DigestVerifier<MsgDigest, Signature> for VerifyingKey
Available on crate feature digest
only.
impl<MsgDigest> DigestVerifier<MsgDigest, Signature> for VerifyingKey
digest
only.Equivalent to VerifyingKey::verify_prehashed
with context
set to None
.
source§fn verify_digest(
&self,
msg_digest: MsgDigest,
signature: &Signature
) -> Result<(), SignatureError>
fn verify_digest( &self, msg_digest: MsgDigest, signature: &Signature ) -> Result<(), SignatureError>
Digest
output.source§impl EncodePublicKey for VerifyingKey
Available on crate features alloc
and pkcs8
only.
impl EncodePublicKey for VerifyingKey
alloc
and pkcs8
only.source§fn to_public_key_der(&self) -> Result<Document>
fn to_public_key_der(&self) -> Result<Document>
Document
containing a SPKI-encoded public key.§fn to_public_key_pem(&self, line_ending: LineEnding) -> Result<String, Error>
fn to_public_key_pem(&self, line_ending: LineEnding) -> Result<String, Error>
pem
only.LineEnding
.§fn write_public_key_der_file(&self, path: impl AsRef<Path>) -> Result<(), Error>
fn write_public_key_der_file(&self, path: impl AsRef<Path>) -> Result<(), Error>
std
only.§fn write_public_key_pem_file(
&self,
path: impl AsRef<Path>,
line_ending: LineEnding
) -> Result<(), Error>
fn write_public_key_pem_file( &self, path: impl AsRef<Path>, line_ending: LineEnding ) -> Result<(), Error>
pem
and std
only.source§impl From<&ExpandedSecretKey> for VerifyingKey
impl From<&ExpandedSecretKey> for VerifyingKey
source§fn from(expanded_secret_key: &ExpandedSecretKey) -> VerifyingKey
fn from(expanded_secret_key: &ExpandedSecretKey) -> VerifyingKey
Derive this public key from its corresponding ExpandedSecretKey
.
source§impl From<&SigningKey> for VerifyingKey
impl From<&SigningKey> for VerifyingKey
source§fn from(signing_key: &SigningKey) -> VerifyingKey
fn from(signing_key: &SigningKey) -> VerifyingKey
source§impl From<&VerifyingKey> for PublicKeyBytes
Available on crate feature pkcs8
only.
impl From<&VerifyingKey> for PublicKeyBytes
pkcs8
only.source§fn from(verifying_key: &VerifyingKey) -> PublicKeyBytes
fn from(verifying_key: &VerifyingKey) -> PublicKeyBytes
source§impl From<EdwardsPoint> for VerifyingKey
impl From<EdwardsPoint> for VerifyingKey
source§fn from(point: EdwardsPoint) -> VerifyingKey
fn from(point: EdwardsPoint) -> VerifyingKey
source§impl From<VerifyingKey> for PublicKeyBytes
Available on crate feature pkcs8
only.
impl From<VerifyingKey> for PublicKeyBytes
pkcs8
only.source§fn from(verifying_key: VerifyingKey) -> PublicKeyBytes
fn from(verifying_key: VerifyingKey) -> PublicKeyBytes
source§impl Hash for VerifyingKey
impl Hash for VerifyingKey
source§impl PartialEq for VerifyingKey
impl PartialEq for VerifyingKey
source§fn eq(&self, other: &VerifyingKey) -> bool
fn eq(&self, other: &VerifyingKey) -> bool
self
and other
values to be equal, and is used
by ==
.source§impl Serialize for VerifyingKey
Available on crate feature serde
only.
impl Serialize for VerifyingKey
serde
only.source§impl TryFrom<&[u8]> for VerifyingKey
impl TryFrom<&[u8]> for VerifyingKey
source§impl TryFrom<&PublicKeyBytes> for VerifyingKey
Available on crate feature pkcs8
only.
impl TryFrom<&PublicKeyBytes> for VerifyingKey
pkcs8
only.source§impl TryFrom<PublicKeyBytes> for VerifyingKey
Available on crate feature pkcs8
only.
impl TryFrom<PublicKeyBytes> for VerifyingKey
pkcs8
only.source§impl TryFrom<SubjectPublicKeyInfo<AnyRef<'_>, BitStringRef<'_>>> for VerifyingKey
Available on crate feature pkcs8
only.
impl TryFrom<SubjectPublicKeyInfo<AnyRef<'_>, BitStringRef<'_>>> for VerifyingKey
pkcs8
only.source§impl Verifier<Signature> for VerifyingKey
impl Verifier<Signature> for VerifyingKey
impl Copy for VerifyingKey
impl Eq for VerifyingKey
Auto Trait Implementations§
impl RefUnwindSafe for VerifyingKey
impl Send for VerifyingKey
impl Sync for VerifyingKey
impl Unpin for VerifyingKey
impl UnwindSafe for VerifyingKey
Blanket Implementations§
source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
§impl<T> DecodePublicKey for T
impl<T> DecodePublicKey for T
§fn from_public_key_der(bytes: &[u8]) -> Result<T, Error>
fn from_public_key_der(bytes: &[u8]) -> Result<T, Error>
SubjectPublicKeyInfo
]
(binary format).§fn from_public_key_pem(s: &str) -> Result<Self, Error>
fn from_public_key_pem(s: &str) -> Result<Self, Error>
pem
only.SubjectPublicKeyInfo
]. Read more