1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338
//! # Public-key signatures
//!
//! This module implements libsodium's public-key signatures, based on Ed25519.
//!
//! ## Classic API example
//!
//! ```
//! use dryoc::classic::crypto_sign::*;
//! use dryoc::constants::CRYPTO_SIGN_BYTES;
//!
//! // Generate a random signing keypair
//! let (public_key, secret_key) = crypto_sign_keypair();
//! let message = b"These violent delights have violent ends...";
//!
//! // Signed message buffer needs to be correct length
//! let mut signed_message = vec![0u8; message.len() + CRYPTO_SIGN_BYTES];
//!
//! // Sign the message, placing the result into `signed_message`
//! crypto_sign(&mut signed_message, message, &secret_key).expect("sign failed");
//!
//! // Allocate a new buffer for opening the message
//! let mut opened_message = vec![0u8; message.len()];
//!
//! // Open the signed message, verifying the signature
//! crypto_sign_open(&mut opened_message, &signed_message, &public_key).expect("verify failed");
//!
//! assert_eq!(&opened_message, message);
//!
//! // Create an invalid message
//! let mut invalid_signed_message = signed_message.clone();
//! invalid_signed_message[5] = !invalid_signed_message[5];
//!
//! // An invalid message can't be verified
//! crypto_sign_open(&mut opened_message, &invalid_signed_message, &public_key)
//! .expect_err("open should not succeed");
//! ```
//!
//! ## Classic API example, detached mode
//!
//! ```
//! use dryoc::classic::crypto_sign::*;
//! use dryoc::constants::CRYPTO_SIGN_BYTES;
//!
//! // Generate a random signing keypair
//! let (public_key, secret_key) = crypto_sign_keypair();
//! let message = b"Brevity is the soul of wit.";
//! let mut signature = [0u8; CRYPTO_SIGN_BYTES];
//!
//! // Sign our message
//! crypto_sign_detached(&mut signature, message, &secret_key).expect("sign failed");
//!
//! // Verify the signature
//! crypto_sign_verify_detached(&signature, message, &public_key).expect("verify failed");
//! ```
use super::crypto_sign_ed25519::*;
pub use super::crypto_sign_ed25519::{PublicKey, SecretKey};
use crate::constants::CRYPTO_SIGN_BYTES;
use crate::error::Error;
/// In-place variant of [`crypto_sign_keypair`].
pub fn crypto_sign_keypair_inplace(public_key: &mut PublicKey, secret_key: &mut SecretKey) {
crypto_sign_ed25519_keypair_inplace(public_key, secret_key)
}
/// In-place variant of [`crypto_sign_seed_keypair`].
pub fn crypto_sign_seed_keypair_inplace(
public_key: &mut PublicKey,
secret_key: &mut SecretKey,
seed: &[u8; 32],
) {
crypto_sign_ed25519_seed_keypair_inplace(public_key, secret_key, seed)
}
/// Randomly generates a new Ed25519 `(PublicKey, SecretKey)` keypair that can
/// be used for message signing.
pub fn crypto_sign_keypair() -> (PublicKey, SecretKey) {
crypto_sign_ed25519_keypair()
}
/// Returns a keypair derived from `seed`, which can be used for message
/// signing.
pub fn crypto_sign_seed_keypair(seed: &[u8; 32]) -> (PublicKey, SecretKey) {
crypto_sign_ed25519_seed_keypair(seed)
}
/// Signs `message`, placing the result into `signed_message`. The length of
/// `signed_message` should be the length of the message plus
/// [`CRYPTO_SIGN_BYTES`].
///
/// This function is compatible with libsodium`s `crypto_sign`, however the
/// `ED25519_NONDETERMINISTIC` feature is not supported.
pub fn crypto_sign(
signed_message: &mut [u8],
message: &[u8],
secret_key: &SecretKey,
) -> Result<(), Error> {
if signed_message.len() != message.len() + CRYPTO_SIGN_BYTES {
Err(dryoc_error!(format!(
"signed_message length incorrect (expect {}, got {})",
message.len() + CRYPTO_SIGN_BYTES,
signed_message.len()
)))
} else {
crypto_sign_ed25519(signed_message, message, secret_key)
}
}
/// Verifies the signature of `signed_message`, placing the result into
/// `message`. The length of `message` should be the length of the signed
/// message minus [`CRYPTO_SIGN_BYTES`].
///
/// This function is compatible with libsodium`s `crypto_sign_open`, however the
/// `ED25519_NONDETERMINISTIC` feature is not supported.
pub fn crypto_sign_open(
message: &mut [u8],
signed_message: &[u8],
public_key: &PublicKey,
) -> Result<(), Error> {
if signed_message.len() < CRYPTO_SIGN_BYTES {
Err(dryoc_error!(format!(
"signed_message length invalid ({} < {})",
signed_message.len(),
CRYPTO_SIGN_BYTES,
)))
} else if message.len() != signed_message.len() - CRYPTO_SIGN_BYTES {
Err(dryoc_error!(format!(
"message length incorrect (expect {}, got {})",
signed_message.len() - CRYPTO_SIGN_BYTES,
message.len()
)))
} else {
crypto_sign_ed25519_open(message, signed_message, public_key)
}
}
/// Signs `message`, placing the signature into `signature` upon success.
/// Detached variant of [`crypto_sign_open`].
///
/// This function is compatible with libsodium`s `crypto_sign_detached`, however
/// the `ED25519_NONDETERMINISTIC` feature is not supported.
pub fn crypto_sign_detached(
signature: &mut Signature,
message: &[u8],
secret_key: &SecretKey,
) -> Result<(), Error> {
crypto_sign_ed25519_detached(signature, message, secret_key)
}
/// Verifies that `signature` is a valid signature for `message` using the given
/// `public_key`.
///
/// This function is compatible with libsodium`s `crypto_sign_verify_detached`,
/// however the `ED25519_NONDETERMINISTIC` feature is not supported.
pub fn crypto_sign_verify_detached(
signature: &Signature,
message: &[u8],
public_key: &PublicKey,
) -> Result<(), Error> {
crypto_sign_ed25519_verify_detached(signature, message, public_key)
}
/// State for incremental signing interface.
pub struct SignerState {
state: Ed25519SignerState,
}
/// Initializes the incremental signing interface.
pub fn crypto_sign_init() -> SignerState {
SignerState {
state: crypto_sign_ed25519ph_init(),
}
}
/// Updates the signature for `state` with `message`.
pub fn crypto_sign_update(state: &mut SignerState, message: &[u8]) {
crypto_sign_ed25519ph_update(&mut state.state, message)
}
/// Finalizes the incremental signature for `state`, using `secret_key`, copying
/// the result into `signature` upon success, and consuming the state.
pub fn crypto_sign_final_create(
state: SignerState,
signature: &mut Signature,
secret_key: &SecretKey,
) -> Result<(), Error> {
crypto_sign_ed25519ph_final_create(state.state, signature, secret_key)
}
/// Verifies the computed signature for `state` and `public_key` matches
/// `signature`, consuming the state.
pub fn crypto_sign_final_verify(
state: SignerState,
signature: &Signature,
public_key: &PublicKey,
) -> Result<(), Error> {
crypto_sign_ed25519ph_final_verify(state.state, signature, public_key)
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn test_crypto_sign() {
use base64::engine::general_purpose;
use base64::Engine as _;
use sodiumoxide::crypto::sign;
for _ in 0..10 {
let (public_key, secret_key) = crypto_sign_keypair();
let message = b"important message";
let mut signed_message = vec![0u8; message.len() + CRYPTO_SIGN_BYTES];
crypto_sign(&mut signed_message, message, &secret_key).expect("sign failed");
let so_signed_message = sign::sign(
message,
&sign::SecretKey::from_slice(&secret_key).expect("secret key failed"),
);
assert_eq!(
general_purpose::STANDARD.encode(&signed_message),
general_purpose::STANDARD.encode(&so_signed_message)
);
let so_m = sign::verify(
&signed_message,
&sign::PublicKey::from_slice(&public_key).expect("public key failed"),
)
.expect("verify failed");
assert_eq!(so_m, message);
}
}
#[test]
fn test_crypto_sign_open() {
use base64::engine::general_purpose;
use base64::Engine as _;
use sodiumoxide::crypto::sign;
for _ in 0..10 {
let (public_key, secret_key) = crypto_sign_keypair();
let message = b"important message";
let mut signed_message = vec![0u8; message.len() + CRYPTO_SIGN_BYTES];
crypto_sign(&mut signed_message, message, &secret_key).expect("sign failed");
let so_signed_message = sign::sign(
message,
&sign::SecretKey::from_slice(&secret_key).expect("secret key failed"),
);
assert_eq!(
general_purpose::STANDARD.encode(&signed_message),
general_purpose::STANDARD.encode(&so_signed_message)
);
let so_m = sign::verify(
&signed_message,
&sign::PublicKey::from_slice(&public_key).expect("public key failed"),
)
.expect("verify failed");
assert_eq!(so_m, message);
let mut opened_message = vec![0u8; message.len()];
crypto_sign_open(&mut opened_message, &signed_message, &public_key)
.expect("verify failed");
assert_eq!(opened_message, message);
}
}
#[test]
fn test_crypto_sign_detached() {
use sodiumoxide::crypto::sign;
for _ in 0..10 {
let (public_key, secret_key) = crypto_sign_keypair();
let message = b"important message";
let mut signature = [0u8; CRYPTO_SIGN_BYTES];
crypto_sign_detached(&mut signature, message, &secret_key).expect("sign failed");
assert!(sign::verify_detached(
&sign::ed25519::Signature::from_bytes(&signature).expect("secret key failed"),
message,
&sign::PublicKey::from_slice(&public_key).expect("public key failed"),
));
crypto_sign_verify_detached(&signature, message, &public_key).expect("verify failed");
}
}
#[test]
fn test_crypto_sign_incremental() {
use sodiumoxide::crypto::sign;
use crate::rng::copy_randombytes;
for _ in 0..10 {
let (public_key, secret_key) = crypto_sign_keypair();
let mut signer = crypto_sign_init();
let mut verifier = crypto_sign_init();
let mut so_signer = sign::State::init();
let mut so_verifier = sign::State::init();
for _ in 0..3 {
let mut randos = vec![0u8; 100];
copy_randombytes(&mut randos);
crypto_sign_update(&mut signer, &randos);
crypto_sign_update(&mut verifier, &randos);
so_signer.update(&randos);
so_verifier.update(&randos);
}
let mut signature = [0u8; CRYPTO_SIGN_BYTES];
crypto_sign_final_create(signer, &mut signature, &secret_key)
.expect("final create failed");
let so_signature = so_signer
.finalize(&sign::SecretKey::from_slice(&secret_key).expect("secret key failed"));
assert_eq!(signature, so_signature.to_bytes());
crypto_sign_final_verify(verifier, &so_signature.to_bytes(), &public_key)
.expect("verify failed");
assert!(so_signer.verify(
&sign::ed25519::Signature::from_bytes(&signature).expect("secret key failed"),
&sign::PublicKey::from_slice(&public_key).expect("public key failed"),
));
}
}
}