Struct tor_hsservice::internal_prelude::HsIdKey
pub(crate) struct HsIdKey(VerifyingKey);
Expand description
The identity of a v3 onion service, expanded into a public key. (KP_hs_id)
This is the decoded and validated ed25519 public key that is encoded as
a ${base32}.onion
address.
This key is not used to sign or validate anything on its own; instead, it is
used to derive a HsBlindIdKey
.
Note: This is a separate type from HsId
because it is about 6x
larger. It is an expanded form, used for doing actual cryptography.
Tuple Fields§
§0: VerifyingKey
Implementations§
§impl HsIdKey
impl HsIdKey
pub fn compute_blinded_key(
&self,
cur_period: TimePeriod
) -> Result<(HsBlindIdKey, Subcredential), BlindingError>
pub fn compute_blinded_key( &self, cur_period: TimePeriod ) -> Result<(HsBlindIdKey, Subcredential), BlindingError>
Derive the blinded key and subcredential for this identity during cur_period
.
pub fn compute_subcredential(
&self,
blinded_key: &HsBlindIdKey,
cur_period: TimePeriod
) -> Subcredential
pub fn compute_subcredential( &self, blinded_key: &HsBlindIdKey, cur_period: TimePeriod ) -> Subcredential
Given a time period and a blinded public key, compute the subcredential.
Methods from Deref<Target = VerifyingKey>§
pub fn is_weak(&self) -> bool
pub fn is_weak(&self) -> bool
Returns whether this is a weak public key, i.e., if this public key has low order.
A weak public key can be used to generate a signature that’s valid for almost every
message. Self::verify_strict
denies weak keys, but if you want to check for this
property before verification, then use this method.
pub fn verify_strict(
&self,
message: &[u8],
signature: &Signature
) -> Result<(), Error>
pub fn verify_strict( &self, message: &[u8], signature: &Signature ) -> Result<(), Error>
Strictly verify a signature on a message with this keypair’s public key.
§On The (Multiple) Sources of Malleability in Ed25519 Signatures
This version of verification is technically non-RFC8032 compliant. The following explains why.
- Scalar Malleability
The authors of the RFC explicitly stated that verification of an ed25519
signature must fail if the scalar s
is not properly reduced mod $\ell$:
To verify a signature on a message M using public key A, with F being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or Ed25519ph is being used, C being the context, first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A’. If any of the decodings fail (including S being out of range), the signature is invalid.)
All verify_*()
functions within ed25519-dalek perform this check.
- Point malleability
The authors of the RFC added in a malleability check to step #3 in
§5.1.7, for small torsion components in the R
value of the signature,
which is not strictly required, as they state:
Check the group equation [8][S]B = [8]R + [8][k]A’. It’s sufficient, but not required, to instead check [S]B = R + [k]A’.
§History of Malleability Checks
As originally defined (cf. the “Malleability” section in the README of this repo), ed25519 signatures didn’t consider any form of malleability to be an issue. Later the scalar malleability was considered important. Still later, particularly with interests in cryptocurrency design and in unique identities (e.g. for Signal users, Tor onion services, etc.), the group element malleability became a concern.
However, libraries had already been created to conform to the original definition. One well-used library in particular even implemented the group element malleability check, but only for batch verification! Which meant that even using the same library, a single signature could verify fine individually, but suddenly, when verifying it with a bunch of other signatures, the whole batch would fail!
§“Strict” Verification
This method performs both of the above signature malleability checks.
It must be done as a separate method because one doesn’t simply get to change the definition of a cryptographic primitive ten years after-the-fact with zero consideration for backwards compatibility in hardware and protocols which have it already have the older definition baked in.
§Return
Returns Ok(())
if the signature is valid, and Err
otherwise.
pub fn to_montgomery(&self) -> MontgomeryPoint
pub fn to_montgomery(&self) -> MontgomeryPoint
Convert this verifying key into Montgomery form.
This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The output of
this function is a valid X25519 public key whose secret key is sk.to_scalar_bytes()
,
where sk
is a valid signing key for this VerifyingKey
.
§Note
We do NOT recommend this usage of a signing/verifying key. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.
For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.
Trait Implementations§
§impl AsRef<VerifyingKey> for HsIdKey
impl AsRef<VerifyingKey> for HsIdKey
§fn as_ref(&self) -> &VerifyingKey
fn as_ref(&self) -> &VerifyingKey
§impl From<&HsIdKeypair> for HsIdKey
impl From<&HsIdKeypair> for HsIdKey
§fn from(value: &HsIdKeypair) -> HsIdKey
fn from(value: &HsIdKeypair) -> HsIdKey
§impl From<HsIdKey> for VerifyingKey
impl From<HsIdKey> for VerifyingKey
§fn from(original: HsIdKey) -> VerifyingKey
fn from(original: HsIdKey) -> VerifyingKey
§impl From<VerifyingKey> for HsIdKey
impl From<VerifyingKey> for HsIdKey
§fn from(original: VerifyingKey) -> HsIdKey
fn from(original: VerifyingKey) -> HsIdKey
source§impl ToEncodableKey for HsIdKey
impl ToEncodableKey for HsIdKey
§type Key = VerifyingKey
type Key = VerifyingKey
source§fn to_encodable_key(self) -> <HsIdKey as ToEncodableKey>::Key
fn to_encodable_key(self) -> <HsIdKey as ToEncodableKey>::Key
EncodableKey
.source§fn from_encodable_key(key: <HsIdKey as ToEncodableKey>::Key) -> HsIdKey
fn from_encodable_key(key: <HsIdKey as ToEncodableKey>::Key) -> HsIdKey
EncodableKey
to another key type.Auto Trait Implementations§
impl Freeze for HsIdKey
impl RefUnwindSafe for HsIdKey
impl Send for HsIdKey
impl Sync for HsIdKey
impl Unpin for HsIdKey
impl UnwindSafe for HsIdKey
Blanket Implementations§
source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
§impl<T> Conv for T
impl<T> Conv for T
§impl<T> Downcast for Twhere
T: Any,
impl<T> Downcast for Twhere
T: Any,
§fn into_any(self: Box<T>) -> Box<dyn Any>
fn into_any(self: Box<T>) -> Box<dyn Any>
Box<dyn Trait>
(where Trait: Downcast
) to Box<dyn Any>
. Box<dyn Any>
can
then be further downcast
into Box<ConcreteType>
where ConcreteType
implements Trait
.§fn into_any_rc(self: Rc<T>) -> Rc<dyn Any>
fn into_any_rc(self: Rc<T>) -> Rc<dyn Any>
Rc<Trait>
(where Trait: Downcast
) to Rc<Any>
. Rc<Any>
can then be
further downcast
into Rc<ConcreteType>
where ConcreteType
implements Trait
.§fn as_any(&self) -> &(dyn Any + 'static)
fn as_any(&self) -> &(dyn Any + 'static)
&Trait
(where Trait: Downcast
) to &Any
. This is needed since Rust cannot
generate &Any
’s vtable from &Trait
’s.§fn as_any_mut(&mut self) -> &mut (dyn Any + 'static)
fn as_any_mut(&mut self) -> &mut (dyn Any + 'static)
&mut Trait
(where Trait: Downcast
) to &Any
. This is needed since Rust cannot
generate &mut Any
’s vtable from &mut Trait
’s.§impl<T> DowncastSync for T
impl<T> DowncastSync for T
§impl<T> FmtForward for T
impl<T> FmtForward for T
§fn fmt_binary(self) -> FmtBinary<Self>where
Self: Binary,
fn fmt_binary(self) -> FmtBinary<Self>where
Self: Binary,
self
to use its Binary
implementation when Debug
-formatted.§fn fmt_display(self) -> FmtDisplay<Self>where
Self: Display,
fn fmt_display(self) -> FmtDisplay<Self>where
Self: Display,
self
to use its Display
implementation when
Debug
-formatted.§fn fmt_lower_exp(self) -> FmtLowerExp<Self>where
Self: LowerExp,
fn fmt_lower_exp(self) -> FmtLowerExp<Self>where
Self: LowerExp,
self
to use its LowerExp
implementation when
Debug
-formatted.§fn fmt_lower_hex(self) -> FmtLowerHex<Self>where
Self: LowerHex,
fn fmt_lower_hex(self) -> FmtLowerHex<Self>where
Self: LowerHex,
self
to use its LowerHex
implementation when
Debug
-formatted.§fn fmt_octal(self) -> FmtOctal<Self>where
Self: Octal,
fn fmt_octal(self) -> FmtOctal<Self>where
Self: Octal,
self
to use its Octal
implementation when Debug
-formatted.§fn fmt_pointer(self) -> FmtPointer<Self>where
Self: Pointer,
fn fmt_pointer(self) -> FmtPointer<Self>where
Self: Pointer,
self
to use its Pointer
implementation when
Debug
-formatted.§fn fmt_upper_exp(self) -> FmtUpperExp<Self>where
Self: UpperExp,
fn fmt_upper_exp(self) -> FmtUpperExp<Self>where
Self: UpperExp,
self
to use its UpperExp
implementation when
Debug
-formatted.§fn fmt_upper_hex(self) -> FmtUpperHex<Self>where
Self: UpperHex,
fn fmt_upper_hex(self) -> FmtUpperHex<Self>where
Self: UpperHex,
self
to use its UpperHex
implementation when
Debug
-formatted.§fn fmt_list(self) -> FmtList<Self>where
&'a Self: for<'a> IntoIterator,
fn fmt_list(self) -> FmtList<Self>where
&'a Self: for<'a> IntoIterator,
§impl<T> Instrument for T
impl<T> Instrument for T
§fn instrument(self, span: Span) -> Instrumented<Self> ⓘ
fn instrument(self, span: Span) -> Instrumented<Self> ⓘ
source§impl<T> IntoEither for T
impl<T> IntoEither for T
source§fn into_either(self, into_left: bool) -> Either<Self, Self> ⓘ
fn into_either(self, into_left: bool) -> Either<Self, Self> ⓘ
self
into a Left
variant of Either<Self, Self>
if into_left
is true
.
Converts self
into a Right
variant of Either<Self, Self>
otherwise. Read moresource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self> ⓘ
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self> ⓘ
self
into a Left
variant of Either<Self, Self>
if into_left(&self)
returns true
.
Converts self
into a Right
variant of Either<Self, Self>
otherwise. Read more§impl<T> Pipe for Twhere
T: ?Sized,
impl<T> Pipe for Twhere
T: ?Sized,
§fn pipe<R>(self, func: impl FnOnce(Self) -> R) -> Rwhere
Self: Sized,
fn pipe<R>(self, func: impl FnOnce(Self) -> R) -> Rwhere
Self: Sized,
§fn pipe_ref<'a, R>(&'a self, func: impl FnOnce(&'a Self) -> R) -> Rwhere
R: 'a,
fn pipe_ref<'a, R>(&'a self, func: impl FnOnce(&'a Self) -> R) -> Rwhere
R: 'a,
self
and passes that borrow into the pipe function. Read more§fn pipe_ref_mut<'a, R>(&'a mut self, func: impl FnOnce(&'a mut Self) -> R) -> Rwhere
R: 'a,
fn pipe_ref_mut<'a, R>(&'a mut self, func: impl FnOnce(&'a mut Self) -> R) -> Rwhere
R: 'a,
self
and passes that borrow into the pipe function. Read more§fn pipe_borrow<'a, B, R>(&'a self, func: impl FnOnce(&'a B) -> R) -> R
fn pipe_borrow<'a, B, R>(&'a self, func: impl FnOnce(&'a B) -> R) -> R
§fn pipe_borrow_mut<'a, B, R>(
&'a mut self,
func: impl FnOnce(&'a mut B) -> R
) -> R
fn pipe_borrow_mut<'a, B, R>( &'a mut self, func: impl FnOnce(&'a mut B) -> R ) -> R
§fn pipe_as_ref<'a, U, R>(&'a self, func: impl FnOnce(&'a U) -> R) -> R
fn pipe_as_ref<'a, U, R>(&'a self, func: impl FnOnce(&'a U) -> R) -> R
self
, then passes self.as_ref()
into the pipe function.§fn pipe_as_mut<'a, U, R>(&'a mut self, func: impl FnOnce(&'a mut U) -> R) -> R
fn pipe_as_mut<'a, U, R>(&'a mut self, func: impl FnOnce(&'a mut U) -> R) -> R
self
, then passes self.as_mut()
into the pipe
function.§fn pipe_deref<'a, T, R>(&'a self, func: impl FnOnce(&'a T) -> R) -> R
fn pipe_deref<'a, T, R>(&'a self, func: impl FnOnce(&'a T) -> R) -> R
self
, then passes self.deref()
into the pipe function.§impl<T> Tap for T
impl<T> Tap for T
§fn tap_borrow<B>(self, func: impl FnOnce(&B)) -> Self
fn tap_borrow<B>(self, func: impl FnOnce(&B)) -> Self
Borrow<B>
of a value. Read more§fn tap_borrow_mut<B>(self, func: impl FnOnce(&mut B)) -> Self
fn tap_borrow_mut<B>(self, func: impl FnOnce(&mut B)) -> Self
BorrowMut<B>
of a value. Read more§fn tap_ref<R>(self, func: impl FnOnce(&R)) -> Self
fn tap_ref<R>(self, func: impl FnOnce(&R)) -> Self
AsRef<R>
view of a value. Read more§fn tap_ref_mut<R>(self, func: impl FnOnce(&mut R)) -> Self
fn tap_ref_mut<R>(self, func: impl FnOnce(&mut R)) -> Self
AsMut<R>
view of a value. Read more§fn tap_deref<T>(self, func: impl FnOnce(&T)) -> Self
fn tap_deref<T>(self, func: impl FnOnce(&T)) -> Self
Deref::Target
of a value. Read more§fn tap_deref_mut<T>(self, func: impl FnOnce(&mut T)) -> Self
fn tap_deref_mut<T>(self, func: impl FnOnce(&mut T)) -> Self
Deref::Target
of a value. Read more§fn tap_dbg(self, func: impl FnOnce(&Self)) -> Self
fn tap_dbg(self, func: impl FnOnce(&Self)) -> Self
.tap()
only in debug builds, and is erased in release builds.§fn tap_mut_dbg(self, func: impl FnOnce(&mut Self)) -> Self
fn tap_mut_dbg(self, func: impl FnOnce(&mut Self)) -> Self
.tap_mut()
only in debug builds, and is erased in release
builds.§fn tap_borrow_dbg<B>(self, func: impl FnOnce(&B)) -> Self
fn tap_borrow_dbg<B>(self, func: impl FnOnce(&B)) -> Self
.tap_borrow()
only in debug builds, and is erased in release
builds.§fn tap_borrow_mut_dbg<B>(self, func: impl FnOnce(&mut B)) -> Self
fn tap_borrow_mut_dbg<B>(self, func: impl FnOnce(&mut B)) -> Self
.tap_borrow_mut()
only in debug builds, and is erased in release
builds.§fn tap_ref_dbg<R>(self, func: impl FnOnce(&R)) -> Self
fn tap_ref_dbg<R>(self, func: impl FnOnce(&R)) -> Self
.tap_ref()
only in debug builds, and is erased in release
builds.§fn tap_ref_mut_dbg<R>(self, func: impl FnOnce(&mut R)) -> Self
fn tap_ref_mut_dbg<R>(self, func: impl FnOnce(&mut R)) -> Self
.tap_ref_mut()
only in debug builds, and is erased in release
builds.§fn tap_deref_dbg<T>(self, func: impl FnOnce(&T)) -> Self
fn tap_deref_dbg<T>(self, func: impl FnOnce(&T)) -> Self
.tap_deref()
only in debug builds, and is erased in release
builds.