Struct ed25519_dalek::VerifyingKey

pub struct VerifyingKey { /* private fields */ }

An ed25519 public key.

Note

The Eq and Hash impls here use the compressed Edwards y encoding, not the algebraic representation. This means if this VerifyingKey is non-canonically encoded, it will be considered unequal to the other equivalent encoding, despite the two representing the same point. More encoding details can be found here. If you want to make sure that signatures produced with respect to those sorts of public keys are rejected, use VerifyingKey::verify_strict.

Implementations

impl VerifyingKey

pub fn to_bytes(&self) -> [u8; 32]

Convert this public key to a byte array.

pub fn as_bytes(&self) -> &[u8; 32]

View this public key as a byte array.

pub fn from_bytes(bytes: &[u8; 32]) -> Result<VerifyingKey, SignatureError>

Construct a VerifyingKey from a slice of bytes.

Warning

The caller is responsible for ensuring that the bytes passed into this method actually represent a curve25519_dalek::curve::CompressedEdwardsY and that said compressed point is actually a point on the curve.

Example

use ed25519_dalek::VerifyingKey;
use ed25519_dalek::PUBLIC_KEY_LENGTH;
use ed25519_dalek::SignatureError;

let public_key_bytes: [u8; PUBLIC_KEY_LENGTH] = [
   215,  90, 152,   1, 130, 177,  10, 183, 213,  75, 254, 211, 201, 100,   7,  58,
    14, 225, 114, 243, 218, 166,  35,  37, 175,   2,  26, 104, 247,   7,   81, 26];

let public_key = VerifyingKey::from_bytes(&public_key_bytes)?;

Returns

A Result whose okay value is an EdDSA VerifyingKey or whose error value is a SignatureError describing the error that occurred.

pub fn with_context<'k, 'v>( &'k self, context_value: &'v [u8] ) -> Result<Context<'k, 'v, Self>, SignatureError>

Available on crate feature digest only.

Create a verifying context that can be used for Ed25519ph with DigestVerifier.

pub fn is_weak(&self) -> bool

Returns whether this is a weak public key, i.e., if this public key has low order.

A weak public key can be used to generate a signature that’s valid for almost every message. Self::verify_strict denies weak keys, but if you want to check for this property before verification, then use this method.

pub fn verify_prehashed<MsgDigest>( &self, prehashed_message: MsgDigest, context: Option<&[u8]>, signature: &Signature ) -> Result<(), SignatureError>

where MsgDigest: Digest<OutputSize = U64>,

Available on crate feature digest only.

Verify a signature on a prehashed_message using the Ed25519ph algorithm.

Inputs

• prehashed_message is an instantiated hash digest with 512-bits of output which has had the message to be signed previously fed into its state.
• context is an optional context string, up to 255 bytes inclusive, which may be used to provide additional domain separation. If not set, this will default to an empty string.
• signature is a purported Ed25519ph signature on the prehashed_message.

Returns

Returns true if the signature was a valid signature created by this SigningKey on the prehashed_message.

Note

The RFC only permits SHA-512 to be used for prehashing, i.e., MsgDigest = Sha512. This function technically works, and is probably safe to use, with any secure hash function with 512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose crate::Sha512 for user convenience.

pub fn verify_strict( &self, message: &[u8], signature: &Signature ) -> Result<(), SignatureError>

Strictly verify a signature on a message with this keypair’s public key.

On The (Multiple) Sources of Malleability in Ed25519 Signatures

This version of verification is technically non-RFC8032 compliant. The following explains why.

1. Scalar Malleability

The authors of the RFC explicitly stated that verification of an ed25519 signature must fail if the scalar s is not properly reduced mod $\ell$:

To verify a signature on a message M using public key A, with F being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or Ed25519ph is being used, C being the context, first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A’. If any of the decodings fail (including S being out of range), the signature is invalid.)

All verify_*() functions within ed25519-dalek perform this check.

2. Point malleability

The authors of the RFC added in a malleability check to step #3 in §5.1.7, for small torsion components in the R value of the signature, which is not strictly required, as they state:

Check the group equation [8][S]B = [8]R + [8][k]A’. It’s sufficient, but not required, to instead check [S]B = R + [k]A’.

History of Malleability Checks

As originally defined (cf. the “Malleability” section in the README of this repo), ed25519 signatures didn’t consider any form of malleability to be an issue. Later the scalar malleability was considered important. Still later, particularly with interests in cryptocurrency design and in unique identities (e.g. for Signal users, Tor onion services, etc.), the group element malleability became a concern.

However, libraries had already been created to conform to the original definition. One well-used library in particular even implemented the group element malleability check, but only for batch verification! Which meant that even using the same library, a single signature could verify fine individually, but suddenly, when verifying it with a bunch of other signatures, the whole batch would fail!

“Strict” Verification

This method performs both of the above signature malleability checks.

It must be done as a separate method because one doesn’t simply get to change the definition of a cryptographic primitive ten years after-the-fact with zero consideration for backwards compatibility in hardware and protocols which have it already have the older definition baked in.

Return

Returns Ok(()) if the signature is valid, and Err otherwise.

pub fn verify_prehashed_strict<MsgDigest>( &self, prehashed_message: MsgDigest, context: Option<&[u8]>, signature: &Signature ) -> Result<(), SignatureError>

where MsgDigest: Digest<OutputSize = U64>,

Available on crate feature digest only.

Verify a signature on a prehashed_message using the Ed25519ph algorithm, using strict signture checking as defined by Self::verify_strict.

Inputs

• prehashed_message is an instantiated hash digest with 512-bits of output which has had the message to be signed previously fed into its state.
• context is an optional context string, up to 255 bytes inclusive, which may be used to provide additional domain separation. If not set, this will default to an empty string.
• signature is a purported Ed25519ph signature on the prehashed_message.

Returns

Returns true if the signature was a valid signature created by this SigningKey on the prehashed_message.

Note

The RFC only permits SHA-512 to be used for prehashing, i.e., MsgDigest = Sha512. This function technically works, and is probably safe to use, with any secure hash function with 512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose crate::Sha512 for user convenience.

pub fn to_montgomery(&self) -> MontgomeryPoint

Convert this verifying key into Montgomery form.

This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The output of this function is a valid X25519 public key whose secret key is sk.to_scalar_bytes(), where sk is a valid signing key for this VerifyingKey.

Note

We do NOT recommend this usage of a signing/verifying key. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.

For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.

Trait Implementations

impl AsRef<[u8]> for VerifyingKey

fn as_ref(&self) -> &[u8]

Converts this type into a shared reference of the (usually inferred) input type.

impl AsRef<VerifyingKey> for SigningKey

fn as_ref(&self) -> &VerifyingKey

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for VerifyingKey

fn clone(&self) -> VerifyingKey

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerifyingKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for VerifyingKey

fn default() -> VerifyingKey

Returns the “default value” for a type.

impl<'d> Deserialize<'d> for VerifyingKey

Available on crate feature serde only.

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'d>,

Deserialize this value from the given Serde deserializer.

impl<MsgDigest> DigestVerifier<MsgDigest, Signature> for VerifyingKey

where MsgDigest: Digest<OutputSize = U64>,

Available on crate feature digest only.

Equivalent to VerifyingKey::verify_prehashed with context set to None.

fn verify_digest( &self, msg_digest: MsgDigest, signature: &Signature ) -> Result<(), SignatureError>

Verify the signature against the given Digest output.

impl EncodePublicKey for VerifyingKey

Available on crate features alloc and pkcs8 only.

fn to_public_key_der(&self) -> Result<Document>

Serialize a Document containing a SPKI-encoded public key.

fn to_public_key_pem(&self, line_ending: LineEnding) -> Result<String, Error>

Available on crate feature pem only.

Serialize this public key as PEM-encoded SPKI with the given LineEnding.

fn write_public_key_der_file(&self, path: impl AsRef<Path>) -> Result<(), Error>

Available on crate feature std only.

Write ASN.1 DER-encoded public key to the given path

fn write_public_key_pem_file( &self, path: impl AsRef<Path>, line_ending: LineEnding ) -> Result<(), Error>

Available on crate features pem and std only.

Write ASN.1 DER-encoded public key to the given path

impl From<&ExpandedSecretKey> for VerifyingKey

fn from(expanded_secret_key: &ExpandedSecretKey) -> VerifyingKey

Derive this public key from its corresponding ExpandedSecretKey.

impl From<&SigningKey> for VerifyingKey

fn from(signing_key: &SigningKey) -> VerifyingKey

Converts to this type from the input type.

impl From<&VerifyingKey> for PublicKeyBytes

Available on crate feature pkcs8 only.

fn from(verifying_key: &VerifyingKey) -> PublicKeyBytes

Converts to this type from the input type.

impl From<EdwardsPoint> for VerifyingKey

fn from(point: EdwardsPoint) -> VerifyingKey

Converts to this type from the input type.

impl From<VerifyingKey> for PublicKeyBytes

Available on crate feature pkcs8 only.

fn from(verifying_key: VerifyingKey) -> PublicKeyBytes

Converts to this type from the input type.

impl Hash for VerifyingKey

fn hash<H: Hasher>(&self, state: &mut H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for VerifyingKey

fn eq(&self, other: &VerifyingKey) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for VerifyingKey

Available on crate feature serde only.

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl TryFrom<&[u8]> for VerifyingKey

type Error = Error

The type returned in the event of a conversion error.

fn try_from(bytes: &[u8]) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<&PublicKeyBytes> for VerifyingKey

Available on crate feature pkcs8 only.

type Error = Error

The type returned in the event of a conversion error.

fn try_from(pkcs8_key: &PublicKeyBytes) -> Result<Self>

Performs the conversion.

impl TryFrom<PublicKeyBytes> for VerifyingKey

Available on crate feature pkcs8 only.

type Error = Error

The type returned in the event of a conversion error.

fn try_from(pkcs8_key: PublicKeyBytes) -> Result<Self>

Performs the conversion.

impl TryFrom<SubjectPublicKeyInfo<AnyRef<'_>, BitStringRef<'_>>> for VerifyingKey

Available on crate feature pkcs8 only.

type Error = Error

The type returned in the event of a conversion error.

fn try_from(public_key: SubjectPublicKeyInfoRef<'_>) -> Result<Self>

Performs the conversion.

impl Verifier<Signature> for VerifyingKey

fn verify( &self, message: &[u8], signature: &Signature ) -> Result<(), SignatureError>

Verify a signature on a message with this keypair’s public key.

Return

Returns Ok(()) if the signature is valid, and Err otherwise.

impl Copy for VerifyingKey

impl Eq for VerifyingKey