Struct Identity

pub struct Identity { /* private fields */ }

Identity struct is an abstraction of public & secret key related operations.

It is basically a wrapper of the keypair (which holds public & secret keys) and a context that will be used for signing.

Implementations

impl Identity

pub fn file_size() -> usize

Size of the identity file on disk

pub fn open_or_create<B: AsRef<Path>>( base_directory: B, ) -> Result<Self, IdentityError>

Opens the existing identity, or creates a new one.

pub fn open<B: AsRef<Path>>( base_directory: B, ) -> Result<Option<Self>, IdentityError>

Opens the existing identity, returns Ok(None) if it doesn’t exist.

pub fn create<B: AsRef<Path>>(base_directory: B) -> Result<Self, IdentityError>

Creates new identity, overrides identity that might already exist.

pub fn public_key(&self) -> &PublicKey

Returns the public key of the identity.

pub fn secret_key(&self) -> &SecretKey

Returns the secret key of the identity.

pub fn entropy(&self) -> &[u8]

Returns entropy used to generate keypair.

pub fn sign_reward_hash(&self, header_hash: &[u8]) -> Signature

Sign reward hash.

Methods from Deref<Target = Keypair>

pub fn to_bytes(&self) -> [u8; 96]

Serialize Keypair to bytes.

Returns

A byte array [u8; KEYPAIR_LENGTH] consisting of first a SecretKey serialized canonically, and next the Ristterro PublicKey

Examples

use schnorrkel::{Keypair, KEYPAIR_LENGTH};

let keypair: Keypair = Keypair::generate();
let bytes: [u8; KEYPAIR_LENGTH] = keypair.to_bytes();
let keypair_too = Keypair::from_bytes(&bytes[..]).unwrap();
assert_eq!(&bytes[..], & keypair_too.to_bytes()[..]);

pub fn to_half_ed25519_bytes(&self) -> [u8; 96]

Serialize Keypair to bytes with Ed25519 secret key format.

Returns

A byte array [u8; KEYPAIR_LENGTH] consisting of first a SecretKey serialized like Ed25519, and next the Ristterro PublicKey

pub fn sign<T>(&self, t: T) -> Signature

where T: SigningTranscript,

Sign a transcript with this keypair’s secret key.

Requires a SigningTranscript, normally created from a SigningContext and a message. Returns a Schnorr signature.

Examples

Internally, we manage signature transcripts using a 128 bit secure STROBE construction based on Keccak, which itself is extremely fast and secure. You might however influence performance or security by prehashing your message, like

use schnorrkel::{Signature,Keypair};
use rand::prelude::*; // ThreadRng,thread_rng
use sha3::Shake128;
use sha3::digest::{Update};

let mut csprng: ThreadRng = thread_rng();
let keypair: Keypair = Keypair::generate_with(&mut csprng);
let message: &[u8] = b"All I want is to pet all of the dogs.";

// Create a hash digest object and feed it the message:
let prehashed = Shake128::default().chain(message);

We require a “context” string for all signatures, which should be chosen judiciously for your project. It should represent the role the signature plays in your application. If you use the context in two purposes, and the same key, then a signature for one purpose can be substituted for the other.

let ctx = signing_context(b"My Signing Context");

let sig: Signature = keypair.sign(ctx.xof(prehashed));

pub fn sign_simple(&self, ctx: &[u8], msg: &[u8]) -> Signature

Sign a message with this keypair’s secret key.

pub fn verify<T>( &self, t: T, signature: &Signature, ) -> Result<(), SignatureError>

where T: SigningTranscript,

Verify a signature by keypair’s public key on a transcript.

Requires a SigningTranscript, normally created from a SigningContext and a message, as well as the signature to be verified.

Examples

use schnorrkel::{Keypair,Signature,signing_context};
use rand::prelude::*; // ThreadRng,thread_rng

let mut csprng: ThreadRng = thread_rng();
let keypair: Keypair = Keypair::generate_with(&mut csprng);
let message: &[u8] = b"All I want is to pet all of the dogs.";

let ctx = signing_context(b"Some context string");

let sig: Signature = keypair.sign(ctx.bytes(message));

assert!( keypair.public.verify(ctx.bytes(message), &sig).is_ok() );

pub fn verify_simple( &self, ctx: &[u8], msg: &[u8], signature: &Signature, ) -> Result<(), SignatureError>

Verify a signature by keypair’s public key on a message.

pub fn sign_doublecheck<T>(&self, t: T) -> Result<Signature, SignatureError>

where T: SigningTranscript + Clone,

Sign a message with this SecretKey, but doublecheck the result.

pub fn sign_simple_doublecheck( &self, ctx: &[u8], msg: &[u8], ) -> Result<Signature, SignatureError>

Sign a message with this SecretKey, but doublecheck the result.

pub fn vrf_create_hash<T>(&self, t: T) -> VRFInOut

where T: VRFSigningTranscript,

Evaluate the VRF on the given transcript.

pub fn dleq_proove<T>( &self, t: T, p: &VRFInOut, kusama: bool, ) -> (VRFProof, VRFProofBatchable)

where T: SigningTranscript,

Produce DLEQ proof.

We assume the VRFInOut paramater has been computed correctly by multiplying every input point by self.secret, like by using one of the vrf_create_* methods on SecretKey. If so, we produce a proof that this multiplication was done correctly.

pub fn vrf_sign<T>(&self, t: T) -> (VRFInOut, VRFProof, VRFProofBatchable)

where T: VRFSigningTranscript,

Run VRF on one single input transcript, producing the outpus and corresponding short proof.

There are schemes like Ouroboros Praos in which nodes evaluate VRFs repeatedly until they win some contest. In these case, you should probably use vrf_sign_n_check to gain access to the VRFInOut from vrf_create_hash first, and then avoid computing the proof whenever you do not win.

pub fn vrf_sign_extra<T, E>( &self, t: T, extra: E, ) -> (VRFInOut, VRFProof, VRFProofBatchable)

where T: VRFSigningTranscript, E: SigningTranscript,

Run VRF on one single input transcript and an extra message transcript, producing the outpus and corresponding short proof.

pub fn vrf_sign_after_check<T, F>( &self, t: T, check: F, ) -> Option<(VRFInOut, VRFProof, VRFProofBatchable)>

where T: VRFSigningTranscript, F: FnMut(&VRFInOut) -> bool,

Run VRF on one single input transcript, producing the outpus and corresponding short proof only if the result first passes some check.

There are schemes like Ouroboros Praos in which nodes evaluate VRFs repeatedly until they win some contest. In these case, you might use this function to short circuit computing the full proof.

pub fn vrf_sign_extra_after_check<T, E, F>( &self, t: T, check: F, ) -> Option<(VRFInOut, VRFProof, VRFProofBatchable)>

where T: VRFSigningTranscript, E: SigningTranscript, F: FnMut(&VRFInOut) -> Option<E>,

Run VRF on one single input transcript, producing the outpus and corresponding short proof only if the result first passes some check, which itself returns an extra message transcript.

pub fn vrfs_sign<T, I>( &self, ts: I, ) -> (Box<[VRFInOut]>, VRFProof, VRFProofBatchable)

where T: VRFSigningTranscript, I: IntoIterator<Item = T>,

Run VRF on several input transcripts, producing their outputs and a common short proof.

We merge the VRF outputs using variable time arithmetic, so if even the hash of the message being signed is sensitive then you might reimplement some constant time variant.

pub fn vrfs_sign_extra<T, E, I>( &self, ts: I, extra: E, ) -> (Box<[VRFInOut]>, VRFProof, VRFProofBatchable)

where T: VRFSigningTranscript, E: SigningTranscript, I: IntoIterator<Item = T>,

Run VRF on several input transcripts and an extra message transcript, producing their outputs and a common short proof.

We merge the VRF outputs using variable time arithmetic, so if even the hash of the message being signed is sensitive then you might reimplement some constant time variant.

pub fn hard_derive_mini_secret_key<B>( &self, cc: Option<ChainCode>, i: B, ) -> (MiniSecretKey, ChainCode)

where B: AsRef<[u8]>,

Vaguely BIP32-like “hard” derivation of a MiniSecretKey from a SecretKey

We do not envision any “good reasons” why these “hard” derivations should ever be used after the soft Derivation trait. We similarly do not believe hard derivations make any sense for ChainCodes or ExtendedKeys types. Yet, some existing BIP32 workflows might do these things, due to BIP32’s de facto standardization and poor design. In consequence, we provide this method to do “hard” derivations in a way that should work with all BIP32 workflows and any permissible mutations of SecretKey. This means only that we hash the SecretKey’s scalar, but not its nonce because the secret key remains valid if the nonce is changed.

pub fn derive_secret_key<T>( &self, t: T, cc: ChainCode, ) -> (SecretKey, ChainCode)

where T: SigningTranscript,

Derive a secret key and new chain code from a key pair and chain code.

We expect the trait methods of Keypair as Derivation to be more useful since signing anything requires the public key too.

pub fn issue_adaptor_cert<T>( &self, t: T, seed_public_key: &PublicKey, ) -> AdaptorCertSecret

where T: SigningTranscript,

Issue an Adaptor implicit certificate

Aside from the issuing Keypair supplied as self, you provide both (1) a SigningTranscript called t that incorporates both the context and the certificate requester’s identity, and (2) the seed_public_key supplied by the certificate recipient in their certificate request. We return an AdaptorCertSecret which the issuer sent to the certificate requester, ans from which the certificate requester derives their certified key pair.

pub fn issue_self_adaptor_cert<T>(&self, t: T) -> (AdaptorCertPublic, SecretKey)

where T: SigningTranscript + Clone,

Issue an Adaptor Implicit Certificate for yourself

We can issue an implicit certificate to ourselves if we merely want to certify an associated public key. We should prefer this option over “hierarchical deterministic” key derivation because compromising the resulting secret key does not compromise the issuer’s secret key.

In this case, we avoid the entire interactive protocol described by issue_adaptor_cert and accept_adaptor_cert by hiding it an all management of the ephemeral Keypair inside this function.

Aside from the issuing secret key supplied as self, you provide only a digest h that incorporates any context and metadata pertaining to the issued key.

pub fn musig<'k, T>(&'k self, t: T) -> MuSig<T, CommitStage<&'k Keypair>>

where T: SigningTranscript + Clone,

👎Deprecated since 0.11.0: This module will be replaced in the future

Initialize a multi-signature aka cosignature protocol run.

We borrow the keypair here to discurage keeping too many copies of the private key, but the MuSig::new method can create an owned version, or use Rc or Arc.

Trait Implementations

impl Clone for Identity

fn clone(&self) -> Identity

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Identity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Deref for Identity

type Target = Keypair

The resulting type after dereferencing.

fn deref(&self) -> &Self::Target

Dereferences the value.