Struct schnorrkel::keys::PublicKey

pub struct PublicKey(_);

A Ristretto Schnorr public key.

Internally, these are represented as a RistrettoPoint, meaning an Edwards point with a static guarantee to be 2-torsion free.

At present, we decompress PublicKeys into this representation during deserialization, which improves error handling, but costs a compression during signing and verifiaction.

Implementations

impl PublicKey

pub fn as_compressed(&self) -> &CompressedRistretto

Access the compressed Ristretto form

pub fn into_compressed(self) -> CompressedRistretto

Extract the compressed Ristretto form

pub fn as_point(&self) -> &RistrettoPoint

Access the point form

pub fn into_point(self) -> RistrettoPoint

Extract the point form

pub fn from_compressed(
    compressed: CompressedRistretto
) -> SignatureResult<PublicKey>

Decompress into the PublicKey format that also retains the compressed form.

pub fn from_point(point: RistrettoPoint) -> PublicKey

Compress into the PublicKey format that also retains the uncompressed form.

pub fn to_bytes(&self) -> [u8; 32]

Convert this public key to a byte array.

Example

use schnorrkel::{SecretKey, PublicKey, PUBLIC_KEY_LENGTH, SignatureError};

let public_key: PublicKey = SecretKey::generate().to_public();
let public_key_bytes = public_key.to_bytes();
let public_key_again: PublicKey = PublicKey::from_bytes(&public_key_bytes[..]).unwrap();
assert_eq!(public_key_bytes, public_key_again.to_bytes());

pub fn from_bytes(bytes: &[u8]) -> SignatureResult<PublicKey>

Construct a PublicKey from a slice of bytes.

Example

use schnorrkel::{PublicKey, PUBLIC_KEY_LENGTH, SignatureError};

let public_key_bytes: [u8; PUBLIC_KEY_LENGTH] = [
    208, 120, 140, 129, 177, 179, 237, 159,
    252, 160, 028, 013, 206, 005, 211, 241,
    192, 218, 001, 097, 130, 241, 020, 169,
    119, 046, 246, 029, 079, 080, 077, 084];

let public_key = PublicKey::from_bytes(&public_key_bytes).unwrap();
assert_eq!(public_key.to_bytes(), public_key_bytes);

Returns

A Result whose okay value is an EdDSA PublicKey or whose error value is an SignatureError describing the error that occurred.

impl PublicKey

pub fn verify<T: SigningTranscript>(
    &self,
    t: T,
    signature: &Signature
) -> SignatureResult<()>

Verify a signature by this public key on a transcript.

Requires a SigningTranscript, normally created from a SigningContext and a message, as well as the signature to be verified.

pub fn verify_simple(
    &self,
    ctx: &[u8],
    msg: &[u8],
    signature: &Signature
) -> SignatureResult<()>

Verify a signature by this public key on a message.

pub fn verify_simple_preaudit_deprecated(
    &self,
    ctx: &'static [u8],
    msg: &[u8],
    sig: &[u8]
) -> SignatureResult<()>

A temporary verification routine for use in transitioning substrate testnets only.

impl PublicKey

pub fn vrf_hash<T>(&self, t: T) -> RistrettoBoth where
    T: VRFSigningTranscript, 

Create a non-malleable VRF input point by hashing a transcript to a point.

pub fn vrf_attach_hash<T>(
    &self,
    output: VRFOutput,
    t: T
) -> SignatureResult<VRFInOut> where
    T: VRFSigningTranscript, 

Pair a non-malleable VRF output with the hash of the given transcript.

impl PublicKey

pub fn vrfs_merge<B>(&self, ps: &[B], vartime: bool) -> VRFInOut where
    B: Borrow<VRFInOut>, 

Merge VRF input and output pairs from the same signer, using variable time arithmetic

You should use vartime=true when verifying VRF proofs batched by the singer. You could usually use vartime=true even when producing proofs, provided the set being signed is not secret.

There is sadly no constant time 128 bit multiplication in dalek, making vartime=false somewhat slower than necessary. It should only impact signers in niche scenarios however, so the slower variant should normally be unnecessary.

Panics if given an empty points list.

TODO: Add constant time 128 bit batched multiplication to dalek. TODO: Is rand_chacha’s gen::<u128>() standardizable enough to prefer it over merlin for the output?

impl PublicKey

pub fn dleq_verify<T>(
    &self,
    t: T,
    p: &VRFInOut,
    proof: &VRFProof,
    kusama: bool
) -> SignatureResult<VRFProofBatchable> where
    T: SigningTranscript, 

Verify DLEQ proof that p.output = s * p.input where self s times the basepoint.

We return an enlarged VRFProofBatchable instead of just true, so that verifiers can forward batchable proofs.

In principle, one might provide “blindly verifiable” VRFs that avoid requiring self here, but naively such constructions risk the same flaws as DLEQ based blind signatures, and this version exploits the slightly faster basepoint arithmetic.

pub fn vrf_verify<T: VRFSigningTranscript>(
    &self,
    t: T,
    out: &VRFOutput,
    proof: &VRFProof
) -> SignatureResult<(VRFInOut, VRFProofBatchable)>

Verify VRF proof for one single input transcript and corresponding output.

pub fn vrf_verify_extra<T, E>(
    &self,
    t: T,
    out: &VRFOutput,
    proof: &VRFProof,
    extra: E
) -> SignatureResult<(VRFInOut, VRFProofBatchable)> where
    T: VRFSigningTranscript,
    E: SigningTranscript, 

Verify VRF proof for one single input transcript and corresponding output.

pub fn vrfs_verify<T, I, O>(
    &self,
    transcripts: I,
    outs: &[O],
    proof: &VRFProof
) -> SignatureResult<(Box<[VRFInOut]>, VRFProofBatchable)> where
    T: VRFSigningTranscript,
    I: IntoIterator<Item = T>,
    O: Borrow<VRFOutput>, 

Verify a common VRF short proof for several input transcripts and corresponding outputs.

pub fn vrfs_verify_extra<T, E, I, O>(
    &self,
    transcripts: I,
    outs: &[O],
    proof: &VRFProof,
    extra: E
) -> SignatureResult<(Box<[VRFInOut]>, VRFProofBatchable)> where
    T: VRFSigningTranscript,
    E: SigningTranscript,
    I: IntoIterator<Item = T>,
    O: Borrow<VRFOutput>, 

Verify a common VRF short proof for several input transcripts and corresponding outputs.

impl PublicKey

pub fn accept_ecqv_cert<T>(
    &self,
    t: T,
    seed_secret_key: &SecretKey,
    cert_secret: ECQVCertSecret
) -> SignatureResult<(ECQVCertPublic, SecretKey)> where
    T: SigningTranscript, 

Accept an ECQV implicit certificate

We request an ECQV implicit certificate by first creating an ephemeral Keypair and sending the public portion to the issuer as seed_public_key. An issuer issues the certificat by replying with the ECQVCertSecret created by issue_ecqv_cert.

Aside from the issuer PublicKey supplied as self, you provide (1) a SigningTranscript called t that incorporates both the context and the certificate requester’s identity, (2) the seed_secret_key corresponding to the seed_public_key they sent to the issuer by the certificate recipient in their certificate request, and (3) the ECQVCertSecret send by the issuer to the certificate requester. We return both your certificate’s new SecretKey as well as an ECQVCertPublic from which third parties may derive corresponding public key from h and the issuer’s public key.

impl PublicKey

pub fn open_ecqv_cert<T>(
    &self,
    t: T,
    cert_public: &ECQVCertPublic
) -> SignatureResult<PublicKey> where
    T: SigningTranscript, 

Trait Implementations

impl AsRef<[u8]> for PublicKey

fn as_ref(&self) -> &[u8]

Performs the conversion.

impl Clone for PublicKey

fn clone(&self) -> PublicKey

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PublicKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PublicKey

fn default() -> PublicKey

Returns the “default value” for a type.

impl Derivation for PublicKey

fn derived_key<T>(&self, t: T, cc: ChainCode) -> (PublicKey, ChainCode) where
    T: SigningTranscript, 

Derive key with subkey identified by a byte array presented via a SigningTranscript, and a chain code.

fn derived_key_simple<B: AsRef<[u8]>>(
    &self,
    cc: ChainCode,
    i: B
) -> (Self, ChainCode)

Derive key with subkey identified by a byte array and a chain code. We do not include a context here becuase the chain code could serve this purpose.

fn derived_key_simple_rng<B, R>(
    &self,
    cc: ChainCode,
    i: B,
    rng: R
) -> (Self, ChainCode) where
    B: AsRef<[u8]>,
    R: RngCore + CryptoRng, 

Derive key with subkey identified by a byte array and a chain code, and with external ranodmnesses.

impl From<SecretKey> for PublicKey

fn from(source: SecretKey) -> PublicKey

Performs the conversion.

impl Hash for PublicKey

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H) where
    H: Hasher, 

Feeds a slice of this type into the given Hasher.

impl Ord for PublicKey

fn cmp(&self, other: &PublicKey) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

Restrict a value to a certain interval.

impl PartialEq<PublicKey> for PublicKey

fn eq(&self, other: &PublicKey) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &PublicKey) -> bool

This method tests for !=.

impl PartialOrd<PublicKey> for PublicKey

fn partial_cmp(&self, other: &PublicKey) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

This method tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

This method tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

This method tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

This method tests greater than or equal to (for self and other) and is used by the >= operator.

impl Copy for PublicKey

impl Eq for PublicKey

impl StructuralEq for PublicKey

impl StructuralPartialEq for PublicKey