Struct ed25519_dalek::Signature

pub struct Signature { /* fields omitted */ }

An ed25519 signature.

Note

These signatures, unlike the ed25519 signature reference implementation, are "detached"—that is, they do not include a copy of the message which has been signed.

Methods

impl Signature

pub fn to_bytes(&self) -> [u8; 64]

Convert this Signature to a byte array.

pub fn from_bytes(bytes: &[u8]) -> Result<Signature, SignatureError>

Construct a Signature from a slice of bytes.

Scalar Malleability Checking

As originally specified in the ed25519 paper (cf. the "Malleability" section of the README in this repo), no checks whatsoever were performed for signature malleability.

Later, a semi-functional, hacky check was added to most libraries to "ensure" that the scalar portion, s, of the signature was reduced mod \ell, the order of the basepoint:

if signature.s[31] & 224 != 0 {
    return Err();
}

This bit-twiddling ensures that the most significant three bits of the scalar are not set:

>>> 0b00010000 & 224
0
>>> 0b00100000 & 224
32
>>> 0b01000000 & 224
64
>>> 0b10000000 & 224
128

However, this check is hacky and insufficient to check that the scalar is fully reduced mod \ell = 2^252 + 27742317777372353535851937790883648493 as it leaves us with a guanteed bound of 253 bits. This means that there are 2^253 - 2^252 + 2774231777737235353585193779088364849311 remaining scalars which could cause malleabilllity.

RFC8032 states:

To verify a signature on a message M using public key A, [...] first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A'. If any of the decodings fail (including S being out of range), the signature is invalid.

However, by the time this was standardised, most libraries in use were only checking the most significant three bits. (See also the documentation for PublicKey.verify_strict.)

Trait Implementations

impl Clone for Signature

fn clone(&self) -> Self

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Signature

impl Debug for Signature

fn fmt(&self, f: &mut Formatter) -> Result

Formats the value using the given formatter.

impl Eq for Signature

impl PartialEq<Signature> for Signature

fn eq(&self, other: &Signature) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Signature) -> bool

This method tests for !=.

impl StructuralEq for Signature

impl StructuralPartialEq for Signature