Of these only `rand_core` is included in the public API; regardless of `rand`
semver tricks, this is a breaking API change, but the major version is already
bumped to include the Serde serialization fixes.
By default, Cargo treats version specifiers as semver-compatible ranges, so the
version specifiers we include should only have the components that are actually
meaningful, e.g., "1" instead of "1.0.0" (which actually means "1").
`zeroize` is WASM-friendly as it has no dependencies on C compilers.
Instead uses Rust's own volatile write semantics and compiler fences to
ensure zeroization is not elided by the compiler.
This is a breaking change to the serialization format. It fixes it so that the
Serde encoding can match the conventional encoding of each type of object, and
so that Serde can be used with no overhead -- when using serde-bincode, the
Serde encoding now matches the manual encoding.
This ensures that the serde Serialize and Deserialize implementations use
fixed-length Serde tuples, rather than variable-length byte arrays. This flaw
in data modeling was pointed out by Trevor Perrin.
This was more useful at the time when we were determining, e.g., optimal lookup
table sizes and could regenerate them more easily, but it came at a massive
complexity cost. It also meant that we were unable to implement backend
autoselection. This commit removes the `build.rs` entirely. In the future, a
different `build.rs` could be added that auto-selects a backend, but it seems
like the current default-u64 setup has been working fine.
Previously, we were checking that the highest 3 bits were unset, which still
leaves 2^253 - 2^252 + 27742317777372353535851937790883648493 potential scalars
for the `s` component of a signature which are not strictly mod \ell.
This change fixes that.
Note: This change makes ed25519-dalek incompatible with ed25519-donna in that
some signatures produced by donna will be verifiable by donna but NOT VERIFIABLE
by dalek. On the other hand, libsodium exports a -DED25519_COMPAT feature,
which when enabled, means it is compatible with dalek with the
`legacy_compatibility` feature disabled. Otherwise, libsodium's behaviour is
identical to the behaviour enabled by default in this patch.
