Struct ed25519_zebra::VerificationKey

pub struct VerificationKey { /* fields omitted */ }

A valid Ed25519 verification key.

This is also called a public key by other implementations.

This type holds decompressed state used in signature verification; if the verification key may not be used immediately, it is probably better to use VerificationKeyBytes, which is a refinement type for [u8; 32].

Zcash-specific consensus properties

Ed25519 checks are described in §5.4.5 of the Zcash protocol specification. However, it is not clear that the protocol specification matches the implementation in libsodium 1.0.15 used by zcashd. Note that the precise version is important because libsodium changed validation rules in point releases.

The spec says that a verification key A is

a point of order l on the Ed25519 curve, in the encoding specified by…

but libsodium 1.0.15 does not check this. Instead it only checks whether the encoding of A is an encoding of a point on the curve and that the encoding is not all zeros. This implementation matches the libsodium behavior. This has implications for signature verification behaviour, as noted in the VerificationKey::verify documentation.

Implementations

impl VerificationKey

pub fn verify(&self, signature: &Signature, msg: &[u8]) -> Result<(), Error>

Verify a purported signature on the given msg.

Zcash-specific consensus properties

Ed25519 checks are described in §5.4.5 of the Zcash protocol specification. Ed25519 validation is not well-specified, and the original implementation of JoinSplit signatures for zcashd inherited its precise validation rules from a specific build configuration of libsodium 1.0.15. Note that the precise version is important because libsodium changed validation rules in point releases.

The additional validation checks are that:

• s MUST represent an integer less than the prime l, per libsodium 1.0.15 crypto_sign/ed25519/ref10/open.c:126;

• R MUST NOT be one of the excluded encodings, per libsodium 1.0.15 crypto_sign/ed25519/ref10/open.c:127;

• The public key bytes must not be all 0, per libsodium 1.0.15 crypto_sign/ed25519/ref10/open.c:138-143, which we maintain as an invariant on the VerificationKey type.

Trait Implementations

impl AsRef<[u8]> for VerificationKey

fn as_ref(&self) -> &[u8]

Performs the conversion.

impl Clone for VerificationKey

fn clone(&self) -> VerificationKey

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for VerificationKey

impl Debug for VerificationKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for VerificationKey

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error> where
    __D: Deserializer<'de>, 

Deserialize this value from the given Serde deserializer.

impl<'a> From<&'a SigningKey> for VerificationKey

fn from(sk: &'a SigningKey) -> VerificationKey

Performs the conversion.

impl From<VerificationKey> for VerificationKeyBytes

fn from(vk: VerificationKey) -> VerificationKeyBytes

Performs the conversion.

impl From<VerificationKey> for [u8; 32]

fn from(vk: VerificationKey) -> [u8; 32]

Performs the conversion.

impl Serialize for VerificationKey

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error> where
    __S: Serializer, 

Serialize this value into the given Serde serializer.

impl<'_> TryFrom<&'_ [u8]> for VerificationKey

type Error = Error

The type returned in the event of a conversion error.

fn try_from(slice: &[u8]) -> Result<VerificationKey, Error>

Performs the conversion.

impl TryFrom<[u8; 32]> for VerificationKey

type Error = Error

The type returned in the event of a conversion error.

fn try_from(bytes: [u8; 32]) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<VerificationKeyBytes> for VerificationKey

type Error = Error

The type returned in the event of a conversion error.

fn try_from(bytes: VerificationKeyBytes) -> Result<Self, Self::Error>

Performs the conversion.