Struct schnorrkel::keys::PublicKey

source ·

pub struct PublicKey(/* private fields */);

Expand description

A Ristretto Schnorr public key.

Internally, these are represented as a RistrettoPoint, meaning an Edwards point with a static guarantee to be 2-torsion free.

At present, we decompress PublicKeys into this representation during deserialization, which improves error handling, but costs a compression during signing and verification.

Implementations§

source §

impl PublicKey

source

pub fn as_compressed(&self) -> &CompressedRistretto

Access the compressed Ristretto form

source

pub fn into_compressed(self) -> CompressedRistretto

Extract the compressed Ristretto form

source

pub fn as_point(&self) -> &RistrettoPoint

Access the point form

source

pub fn into_point(self) -> RistrettoPoint

Extract the point form

source

pub fn from_compressed( compressed: CompressedRistretto, ) -> SignatureResult<PublicKey>

Decompress into the PublicKey format that also retains the compressed form.

source

pub fn from_point(point: RistrettoPoint) -> PublicKey

Compress into the PublicKey format that also retains the uncompressed form.

source

pub fn to_bytes(&self) -> [u8; 32]

Convert this public key to a byte array.

§Example

use schnorrkel::{SecretKey, PublicKey, PUBLIC_KEY_LENGTH, SignatureError};

let public_key: PublicKey = SecretKey::generate().to_public();
let public_key_bytes = public_key.to_bytes();
let public_key_again: PublicKey = PublicKey::from_bytes(&public_key_bytes[..]).unwrap();
assert_eq!(public_key_bytes, public_key_again.to_bytes());

source

pub fn from_bytes(bytes: &[u8]) -> SignatureResult<PublicKey>

Construct a PublicKey from a slice of bytes.

§Example

use schnorrkel::{PublicKey, PUBLIC_KEY_LENGTH, SignatureError};

let public_key_bytes: [u8; PUBLIC_KEY_LENGTH] = [
    208, 120, 140, 129, 177, 179, 237, 159,
    252, 160, 028, 013, 206, 005, 211, 241,
    192, 218, 001, 097, 130, 241, 020, 169,
    119, 046, 246, 029, 079, 080, 077, 084];

let public_key = PublicKey::from_bytes(&public_key_bytes).unwrap();
assert_eq!(public_key.to_bytes(), public_key_bytes);

§Returns

A Result whose okay value is an EdDSA PublicKey or whose error value is an SignatureError describing the error that occurred.

source §

impl PublicKey

source

pub fn verify<T: SigningTranscript>( &self, t: T, signature: &Signature, ) -> SignatureResult<()>

Verify a signature by this public key on a transcript.

Requires a SigningTranscript, normally created from a SigningContext and a message, as well as the signature to be verified.

source

pub fn verify_simple( &self, ctx: &[u8], msg: &[u8], signature: &Signature, ) -> SignatureResult<()>

Verify a signature by this public key on a message.

source

pub fn verify_simple_preaudit_deprecated( &self, ctx: &'static [u8], msg: &[u8], sig: &[u8], ) -> SignatureResult<()>

A temporary verification routine for use in transitioning substrate testnets only.

source §

impl PublicKey

source

pub fn vrf_hash<T>(&self, t: T) -> RistrettoBoth
where T: VRFSigningTranscript,

Create a non-malleable VRF input point by hashing a transcript to a point.

source

pub fn vrf_attach_hash<T>( &self, output: VRFPreOut, t: T, ) -> SignatureResult<VRFInOut>
where T: VRFSigningTranscript,

Pair a non-malleable VRF output with the hash of the given transcript.

source §

impl PublicKey

source

pub fn vrfs_merge(&self, ps: &[B], vartime: bool) -> VRFInOut
where B: Borrow<VRFInOut>,

Merge VRF input and output pairs from the same signer, using variable time arithmetic

You should use vartime=true when verifying VRF proofs batched by the singer. You could usually use vartime=true even when producing proofs, provided the set being signed is not secret.

There is sadly no constant time 128 bit multiplication in dalek, making vartime=false somewhat slower than necessary. It should only impact signers in niche scenarios however, so the slower variant should normally be unnecessary.

Panics if given an empty points list.

TODO: Add constant time 128 bit batched multiplication to dalek. TODO: Is rand_chacha’s gen::<u128>() standardizable enough to prefer it over merlin for the output?

source §

impl PublicKey

source

pub fn dleq_verify<T>( &self, t: T, p: &VRFInOut, proof: &VRFProof, kusama: bool, ) -> SignatureResult<VRFProofBatchable>
where T: SigningTranscript,

Verify DLEQ proof that p.output = s * p.input where self s times the basepoint.

We return an enlarged VRFProofBatchable instead of just true, so that verifiers can forward batchable proofs.

In principle, one might provide “blindly verifiable” VRFs that avoid requiring self here, but naively such constructions risk the same flaws as DLEQ based blind signatures, and this version exploits the slightly faster basepoint arithmetic.

source

pub fn vrf_verify<T: VRFSigningTranscript>( &self, t: T, out: &VRFPreOut, proof: &VRFProof, ) -> SignatureResult<(VRFInOut, VRFProofBatchable)>

Verify VRF proof for one single input transcript and corresponding output.

source

pub fn vrf_verify_extra<T, E>( &self, t: T, out: &VRFPreOut, proof: &VRFProof, extra: E, ) -> SignatureResult<(VRFInOut, VRFProofBatchable)>
where T: VRFSigningTranscript, E: SigningTranscript,

Verify VRF proof for one single input transcript and corresponding output.

source

pub fn vrfs_verify<T, I, O>( &self, transcripts: I, outs: &[O], proof: &VRFProof, ) -> SignatureResult<(Box<[VRFInOut]>, VRFProofBatchable)>
where T: VRFSigningTranscript, I: IntoIterator<Item = T>, O: Borrow<VRFPreOut>,

Verify a common VRF short proof for several input transcripts and corresponding outputs.

source

pub fn vrfs_verify_extra<T, E, I, O>( &self, transcripts: I, outs: &[O], proof: &VRFProof, extra: E, ) -> SignatureResult<(Box<[VRFInOut]>, VRFProofBatchable)>
where T: VRFSigningTranscript, E: SigningTranscript, I: IntoIterator<Item = T>, O: Borrow<VRFPreOut>,

Verify a common VRF short proof for several input transcripts and corresponding outputs.

source §

impl PublicKey

source

pub fn accept_adaptor_cert<T>( &self, t: T, seed_secret_key: &SecretKey, cert_secret: AdaptorCertSecret, ) -> SignatureResult<(AdaptorCertPublic, SecretKey)>
where T: SigningTranscript,

Accept an Adaptor implicit certificate

We request an Adaptor implicit certificate by first creating an ephemeral Keypair and sending the public portion to the issuer as seed_public_key. An issuer issues the certificate by replying with the AdaptorCertSecret created by issue_adaptor_cert.

Aside from the issuer PublicKey supplied as self, you provide (1) a SigningTranscript called t that incorporates both the context and the certificate requester’s identity, (2) the seed_secret_key corresponding to the seed_public_key they sent to the issuer by the certificate recipient in their certificate request, and (3) the AdaptorCertSecret send by the issuer to the certificate requester. We return both your certificate’s new SecretKey as well as an AdaptorCertPublic from which third parties may derive corresponding public key from h and the issuer’s public key.