The `ed25519` v2.2.0 crate bumps the `pkcs8` dependency to v0.10.
This updates `ed25519` to the latest version and updates the PKCS#8
support to use the new API.
Previously it was a 2-tuple containing a `CompressedEdwardsY`
serialization and a decompressed `EdwardsPoint`, however using
`.0` and `.1` for these respectively makes the code hard to read.
This commit changes them to `compressed` and `point`, which as it were
are the names of the local variables used when constructing a
`VerifyingKey`, which improves clarity.
* Added items to changelog for 2.0 release
* Removed unnecessary uses of std in doctests
* Gated `Context` behind `digest`
* Fixed noncompiling doctest when only `digest` is enabled
* README feature flag list mostly done
* Copied changelog to readme
* Redid the malleability section in README
* Added CONTRIBUTING.md
* Bumped version number to 2.0.0-pre.0; small changes to README
* Updated changelog for #277
* Added pem feature description
Co-authored-by: pinkforest(she/her) <36498018+pinkforest@users.noreply.github.com>
* Fixed-based Montgomery scalar multiplication
Adds `MontgomeryPoint::mul_base` as an API for fixed-base scalar
multiplication which allows for potential future optimizations.
As a baseline implementation, it uses the variable base scalar
multiplication implementation.
This follows the existing `EdwardsPoint::mul_base` and
`RistrettoPoint::mul_base` APIs.
* Added Montgomery mul_base bench
* Switched MontgomeryPoint::mul_base to use EdwardsPoint::mul_base
---------
Co-authored-by: Michael Rosenberg <michael@mrosenberg.pub>
Re-exports the following commonly used types from their respective
modules to the toplevel of the crate, which makes them easier to access:
- `EdwardsPoint`
- `MontgomeryPoint`
- `RistrettoPoint`
- `Scalar`
* Add `Context` type
Adds a generic type which can be used with `SigningKey` and
`VerifyingKey` for storing a context string value along with the key for
use with `DigestSigner` and `DigestVerifier`.
* Added Context tests, docs, and re-exports
* Added docs about SHA-512 for prehashing; re-re-exported Sha512
Co-authored-by: Tony Arcieri <bascule@gmail.com>
Co-authored-by: Michael Rosenberg <michael@mrosenberg.pub>
The original v2.0.0 release has been yanked.
This release includes a different infallible parsing API which can be
used to eliminate some usages of `unwrap()`.
* Made all signature R comparisons byte-wise
* Use Scalar::from_bits_clamped rather than manually clamping
* Added clippy lints and comments for use of unwrap()
* Clarify use of unused
* Impl `signature::Digest*` traits for Ed25519ph
Adds the following trait impls:
- impl DigestSigner for SigningKey
- impl DigestVerifier for VerifyingKey
These traits can be used to create and verify Ed25519 signatures,
thunking to `SigningKey::sign_prehashed` and
`VerifyingKey::verify_prehashed` respectively.
* Add rustdoc comments for trait impls
* Add on-by-default `fast` crate feature
Disabling the feature reduces overall code size at the cost of
performance, which is useful for e.g. embedded users.
This feature transitively enables the `basepoint-tables` feature in
`curve25519-dalek` where the basepoint tables are actually defined.
* Consolidated a lot of verification code
* Bump `curve25519-dalek`; use `precomputed-tables` feature
The feature name changed in dalek-cryptography/curve25519-dalek#499
Co-authored-by: Michael Rosenberg <michael@mrosenberg.pub>
The `from_slice` methods on `CompressedEdwardsY` and
`CompressedRistretto` both previously panicked if the slice was the
wrong length.
This changes them to be fallible, returning `TryFromSliceError` in the
event the slice is the wrong length.
It also adds a `TryFrom<&[u8]>` impl for each of these types which calls
the corresponding `from_slice` method.
This is the name we adopted for a similar feature in @RustCrypto.
It's a bit less jargony and also leaves the door open in the future to
other types of precomputed tables.
digest isn't yet stable but we have use it in the public API.
This makes the digest API optional to use in opt-in basis by
feature gating this via an optional digest feature.
API items now feature-gated:
- `pub use ed25519_dalek::Digest`
- `SigningKey::sign_prehashed(D: prehashed_message, ..)`
- `SigningKey::verify_prehashed(D: prehahed_message, ..)`
- `VerifyingKey::verify_prehashed(D: prehashed_message, ..)`
- `VerifyingKey::verify_prehashed_strict(D: prehashed_message, ..)`
Also no longer re-exporting `sha2::Sha512`
Updates to the latest upstream changes in `curve25519-dalek`, including
using the new `EdwardsPoint::mul_base` API.
To keep the build deterministic, this also checks in Cargo.lock, which
pins `curve25519-dalek` to a particular git commit SHA which can be
updated using `cargo update -p curve25519-dalek`.
We can potentially remove `Cargo.lock` again after a crate release.
* Add `basepoint-tables` crate feature
Feature-gates the inclusion of basepoint tables under a
`basepoint-tables` feature, with the goal of reducing code size for e.g.
embedded applications.
* Add `mul_base` method to `EdwardsPoint` and `RistrettoPoint`
Provides fixed-base scalar multiplication which optionally uses
precomputed basepoint tables when the `basepoint-tables` feature is
enabled, providing 4X better performance.
Falls back on variable-base scalar multiplication in the event the
feature is disabled.
Co-authored-by: Michael Rosenberg <michael@mrosenberg.pub>
Calls the inherent `SigningKey::verifying_key` method using `From`
conversions.
This replaces vestigial impl for `SecretKey` which is now an alias for
`[u8; 32]`.
* Fixed bench when `batch` feature is not present
* Added bench build regression test to CI
* Fixed batch build more generally
* Simplified batch cfg gates in benches
* Updated criterion
* Made CI batch-nondeterministic test use nostd
* Fix batch_deterministic build
* Removed bad compile error when batch and batch_deterministic are selected
* Make basepoint table constants static references
This ensures they have a fixed address and aren't duplicated across
compilation units.
Since they were already always borrowed, this changes the static values
to be `&'static` addresses to ensure they're always borrowed rather than
potentially copied.
* rustfmt
