This represents the first breaking change in a new release series,
bumping all crates to the 2024 edition of Rust.
As such, the version numbers of all crates have been incremented to
represent a new prerelease series:
- `curve25519-dalek`: v5.0.0-pre
- `ed25519-dalek`: v3.0.0-pre
- `x25519-dalek`: v3.0.0-pre
Note that this commit isn't intended to cut associated crate releases of
these on crates.io, but is merely bumping the version numbers to denote
there are pending breaking changes.
This commit also includes rustfmt changes which were made as part of the
2024 edition.
Also includes clippy fixes.
* Replace recompute_R with a separate RCompute
This struct can be use to implement verifiers with incremental updates
* Add raw_sign_byupdate and raw_verify_byupdate
These allow signing/verifying a non-prehashed message
but don't require the whole message to be provided at once.
* Tests for raw_sign_byupdate, raw_verify_byupdate
* Add StreamVerifier
* Make StreamVerifier use RCompute
This allows it to use the same implementation as non-stream signature
verification.
* Guard StreamVerifier behind hazmat feature
* docs: disambiguate unsafety
Co-authored-by: Tony Arcieri <bascule@gmail.com>
* chore: relax F bounds on raw_verify_byupdate
* chore: remove raw_sign_byupdate and raw_verify_byupdate
* chore: address clippy lints within new code
* docs: fixup changelog
* test: invert new chunked test
* chore: revert raw_sign
---------
Co-authored-by: Matt Johnston <matt@ucc.asn.au>
Co-authored-by: Tony Arcieri <bascule@gmail.com>
Removes the previous warning that points are unvalidated: they're
validated using the ZIP-215 rules, which allows unreduced y-coordinates.
Points are ensured valid by performing decompression, which finds a
solution to the curve equation, or returns an error.
Adds references to ZIP-215 and dalek-cryptography/curve25519-dalek#626
which is an issue about potentially adding support for the RFC8032/NIST
validation criteria in the future.
* ed25519-dalek: remove `ExpandedSecretKey::to_bytes`
The reason `ExpandedSecretKey` needs a private `scalar_bytes` field is
to retain the canonical scalar bytes as output by SHA-512 during key
expansion so they can be serialized by the `to_bytes` method.
However, `ExpandedSecretKey`s should not be serialized to the wire.
Removing this method allows the private field to be removed, which
allows `ExpandedSecretKey` to be constructed entirely from public
fields. This provides an alternative to #544 for use cases like
Ed25519-BIP32 where the private scalar is derived rather than clamped
from bytes.
One other change is needed: `to_scalar_bytes` was changed to `to_scalar`
as the canonical scalar bytes are no longer retained, however this has
no impact on its main use case, X25519 Diffie-Hellman exchanges, where
the `Scalar` should NOT be written to the wire anyway.
* Added scalar byte comparison back to ed25519-dalek x25519 test
---------
Co-authored-by: Michael Rosenberg <michael@mrosenberg.pub>
