Module ed25519_verify 

Ed25519 verification-key minting (RFC 8032).

Ed25519 has no parameters: 32-byte public keys, 64-byte signatures. Keys report algorithm-name "Ed25519" and none for curve and hash.

Security — the verification criterion. RFC 8032 leaves edge cases open and real implementations disagree on them; divergent verify results across providers is a vulnerability class, so this interface pins one policy:

• Keys minted here verify with the cofactorless equation ([S]B = R + [k]A).
• Implementations MUST reject signatures with a non-canonical scalar (S ≥ L), a non-canonically-encoded or small-order R, and keys with a non-canonically-encoded or small-order A — the strict semantics of ed25519-dalek’s verify_strict.
• Whether a degenerate A is rejected at import (error.invalid-key) or at verification (error.authentication-failed) is implementation-defined; the guarantee is that no signature ever verifies under one.
• Inputs with mixed-order (torsion-component, not small-order) A or R are the remaining freedom: they verify iff the cofactorless equation holds.

None of the rejected inputs can be produced by an honest RFC 8032 signer, so this strictness costs no interoperability.

Functions

import_verifying_key_jwk

Import a public key as an RFC 8037 OKP public JWK (kty: "OKP", crv: "Ed25519", x). jwk is the JWK as JSON text; see mac-key.export-key-jwk for the package-wide JWK contract. An alg member, when present, must be "Ed25519" or "EdDSA". The same strict point criterion applies.

import_verifying_key_raw

Import a 32-byte raw public key (RFC 8032 encoding). Material of any other length fails with error.invalid-key; a non-canonical or small-order encoding is rejected here or at verification, per the interface’s verification criterion.

import_verifying_key_spki

Import a public key as an X.509 SubjectPublicKeyInfo (DER, RFC 8410 algorithm id 1.3.101.112). The embedded point is subject to the same strict criterion as import-verifying-key-raw.

Type Aliases

Error

VerifyingKey