chore: checkpoint before Python removal

vendor/ed25519-dalek/src/batch.rs

@@ -0,0 +1,241 @@
+// -*- mode: rust; -*-
+//
+// This file is part of ed25519-dalek.
+// Copyright (c) 2017-2019 isis lovecruft
+// See LICENSE for licensing information.
+//
+// Authors:
+// - isis agora lovecruft <isis@patternsinthevoid.net>
+
+//! Batch signature verification.
+
+use alloc::vec::Vec;
+
+use core::iter::once;
+
+use curve25519_dalek::constants;
+use curve25519_dalek::edwards::EdwardsPoint;
+use curve25519_dalek::scalar::Scalar;
+use curve25519_dalek::traits::IsIdentity;
+use curve25519_dalek::traits::VartimeMultiscalarMul;
+
+pub use curve25519_dalek::digest::Digest;
+
+use merlin::Transcript;
+
+use rand_core::RngCore;
+
+use sha2::Sha512;
+
+use crate::errors::InternalError;
+use crate::errors::SignatureError;
+use crate::signature::InternalSignature;
+use crate::VerifyingKey;
+
+/// An implementation of `rand_core::RngCore` which does nothing. This is necessary because merlin
+/// demands an `Rng` as input to `TranscriptRngBuilder::finalize()`. Using this with `finalize()`
+/// yields a PRG whose input is the hashed transcript.
+struct ZeroRng;
+
+impl rand_core::RngCore for ZeroRng {
+    fn next_u32(&mut self) -> u32 {
+        rand_core::impls::next_u32_via_fill(self)
+    }
+
+    fn next_u64(&mut self) -> u64 {
+        rand_core::impls::next_u64_via_fill(self)
+    }
+
+    /// A no-op function which leaves the destination bytes for randomness unchanged.
+    ///
+    /// In this case, the internal merlin code is initialising the destination
+    /// by doing `[0u8; …]`, which means that when we call
+    /// `merlin::TranscriptRngBuilder.finalize()`, rather than rekeying the
+    /// STROBE state based on external randomness, we're doing an
+    /// `ENC_{state}(00000000000000000000000000000000)` operation, which is
+    /// identical to the STROBE `MAC` operation.
+    fn fill_bytes(&mut self, _dest: &mut [u8]) {}
+
+    fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), rand_core::Error> {
+        self.fill_bytes(dest);
+        Ok(())
+    }
+}
+
+// `TranscriptRngBuilder::finalize()` requires a `CryptoRng`
+impl rand_core::CryptoRng for ZeroRng {}
+
+// We write our own gen() function so we don't need to pull in the rand crate
+fn gen_u128<R: RngCore>(rng: &mut R) -> u128 {
+    let mut buf = [0u8; 16];
+    rng.fill_bytes(&mut buf);
+    u128::from_le_bytes(buf)
+}
+
+/// Verify a batch of `signatures` on `messages` with their respective `verifying_keys`.
+///
+/// # Inputs
+///
+/// * `messages` is a slice of byte slices, one per signed message.
+/// * `signatures` is a slice of `Signature`s.
+/// * `verifying_keys` is a slice of `VerifyingKey`s.
+///
+/// # Returns
+///
+/// * A `Result` whose `Ok` value is an empty tuple and whose `Err` value is a
+///   `SignatureError` containing a description of the internal error which
+///   occurred.
+///
+/// ## On Deterministic Nonces
+///
+/// The nonces for batch signature verification are derived purely from the inputs to this function
+/// themselves.
+///
+/// In any sigma protocol it is wise to include as much context pertaining
+/// to the public state in the protocol as possible, to avoid malleability
+/// attacks where an adversary alters publics in an algebraic manner that
+/// manages to satisfy the equations for the protocol in question.
+///
+/// For ed25519 batch verification we include the following as scalars in the protocol transcript:
+///
+/// * All of the computed `H(R||A||M)`s to the protocol transcript, and
+/// * All of the `s` components of each signature.
+///
+/// The former, while not quite as elegant as adding the `R`s, `A`s, and
+/// `M`s separately, saves us a bit of context hashing since the
+/// `H(R||A||M)`s need to be computed for the verification equation anyway.
+///
+/// The latter prevents a malleability attack wherein an adversary, without access
+/// to the signing key(s), can take any valid signature, `(s,R)`, and swap
+/// `s` with `s' = -z1`.  This doesn't constitute a signature forgery, merely
+/// a vulnerability, as the resulting signature will not pass single
+/// signature verification.  (Thanks to Github users @real_or_random and
+/// @jonasnick for pointing out this malleability issue.)
+///
+/// # Examples
+///
+/// ```
+/// use ed25519_dalek::{
+///     verify_batch, SigningKey, VerifyingKey, Signer, Signature,
+/// };
+/// use rand::rngs::OsRng;
+///
+/// # fn main() {
+/// let mut csprng = OsRng;
+/// let signing_keys: Vec<_> = (0..64).map(|_| SigningKey::generate(&mut csprng)).collect();
+/// let msg: &[u8] = b"They're good dogs Brant";
+/// let messages: Vec<_> = (0..64).map(|_| msg).collect();
+/// let signatures:  Vec<_> = signing_keys.iter().map(|key| key.sign(&msg)).collect();
+/// let verifying_keys: Vec<_> = signing_keys.iter().map(|key| key.verifying_key()).collect();
+///
+/// let result = verify_batch(&messages, &signatures, &verifying_keys);
+/// assert!(result.is_ok());
+/// # }
+/// ```
+#[allow(non_snake_case)]
+pub fn verify_batch(
+    messages: &[&[u8]],
+    signatures: &[ed25519::Signature],
+    verifying_keys: &[VerifyingKey],
+) -> Result<(), SignatureError> {
+    // Return an Error if any of the vectors were not the same size as the others.
+    if signatures.len() != messages.len()
+        || signatures.len() != verifying_keys.len()
+        || verifying_keys.len() != messages.len()
+    {
+        return Err(InternalError::ArrayLength {
+            name_a: "signatures",
+            length_a: signatures.len(),
+            name_b: "messages",
+            length_b: messages.len(),
+            name_c: "verifying_keys",
+            length_c: verifying_keys.len(),
+        }
+        .into());
+    }
+
+    // Make a transcript which logs all inputs to this function
+    let mut transcript: Transcript = Transcript::new(b"ed25519 batch verification");
+
+    // We make one optimization in the transcript: since we will end up computing H(R || A || M)
+    // for each (R, A, M) triplet, we will feed _that_ into our transcript rather than each R, A, M
+    // individually. Since R and A are fixed-length, this modification is secure so long as SHA-512
+    // is collision-resistant.
+    // It suffices to take `verifying_keys[i].as_bytes()` even though a `VerifyingKey` has two
+    // fields, and `as_bytes()` only returns the bytes of the first. This is because of an
+    // invariant guaranteed by `VerifyingKey`: the second field is always the (unique)
+    // decompression of the first. Thus, the serialized first field is a unique representation of
+    // the entire `VerifyingKey`.
+    let hrams: Vec<[u8; 64]> = (0..signatures.len())
+        .map(|i| {
+            // Compute H(R || A || M), where
+            // R = sig.R
+            // A = verifying key
+            // M = msg
+            let mut h: Sha512 = Sha512::default();
+            h.update(signatures[i].r_bytes());
+            h.update(verifying_keys[i].as_bytes());
+            h.update(messages[i]);
+            *h.finalize().as_ref()
+        })
+        .collect();
+
+    // Update transcript with the hashes above. This covers verifying_keys, messages, and the R
+    // half of signatures
+    for hram in hrams.iter() {
+        transcript.append_message(b"hram", hram);
+    }
+    // Update transcript with the rest of the data. This covers the s half of the signatures
+    for sig in signatures {
+        transcript.append_message(b"sig.s", sig.s_bytes());
+    }
+
+    // All function inputs have now been hashed into the transcript. Finalize it and use it as
+    // randomness for the batch verification.
+    let mut rng = transcript.build_rng().finalize(&mut ZeroRng);
+
+    // Convert all signatures to `InternalSignature`
+    let signatures = signatures
+        .iter()
+        .map(InternalSignature::try_from)
+        .collect::<Result<Vec<_>, _>>()?;
+    // Convert the H(R || A || M) values into scalars
+    let hrams: Vec<Scalar> = hrams
+        .iter()
+        .map(Scalar::from_bytes_mod_order_wide)
+        .collect();
+
+    // Select a random 128-bit scalar for each signature.
+    let zs: Vec<Scalar> = signatures
+        .iter()
+        .map(|_| Scalar::from(gen_u128(&mut rng)))
+        .collect();
+
+    // Compute the basepoint coefficient, ∑ s[i]z[i] (mod l)
+    let B_coefficient: Scalar = signatures
+        .iter()
+        .map(|sig| sig.s)
+        .zip(zs.iter())
+        .map(|(s, z)| z * s)
+        .sum();
+
+    // Multiply each H(R || A || M) by the random value
+    let zhrams = hrams.iter().zip(zs.iter()).map(|(hram, z)| hram * z);
+
+    let Rs = signatures.iter().map(|sig| sig.R.decompress());
+    let As = verifying_keys.iter().map(|pk| Some(pk.point));
+    let B = once(Some(constants::ED25519_BASEPOINT_POINT));
+
+    // Compute (-∑ z[i]s[i] (mod l)) B + ∑ z[i]R[i] + ∑ (z[i]H(R||A||M)[i] (mod l)) A[i] = 0
+    let id = EdwardsPoint::optional_multiscalar_mul(
+        once(-B_coefficient).chain(zs.iter().cloned()).chain(zhrams),
+        B.chain(Rs).chain(As),
+    )
+    .ok_or(InternalError::Verify)?;
+
+    if id.is_identity() {
+        Ok(())
+    } else {
+        Err(InternalError::Verify.into())
+    }
+}

vendor/ed25519-dalek/src/constants.rs

@@ -0,0 +1,32 @@
+// -*- mode: rust; -*-
+//
+// This file is part of ed25519-dalek.
+// Copyright (c) 2017-2019 isis lovecruft
+// See LICENSE for licensing information.
+//
+// Authors:
+// - isis agora lovecruft <isis@patternsinthevoid.net>
+
+//! Common constants such as buffer sizes for keypairs and signatures.
+
+/// The length of a ed25519 `Signature`, in bytes.
+pub const SIGNATURE_LENGTH: usize = 64;
+
+/// The length of a ed25519 `SecretKey`, in bytes.
+pub const SECRET_KEY_LENGTH: usize = 32;
+
+/// The length of an ed25519 `PublicKey`, in bytes.
+pub const PUBLIC_KEY_LENGTH: usize = 32;
+
+/// The length of an ed25519 `Keypair`, in bytes.
+pub const KEYPAIR_LENGTH: usize = SECRET_KEY_LENGTH + PUBLIC_KEY_LENGTH;
+
+/// The length of the "key" portion of an "expanded" ed25519 secret key, in bytes.
+const EXPANDED_SECRET_KEY_KEY_LENGTH: usize = 32;
+
+/// The length of the "nonce" portion of an "expanded" ed25519 secret key, in bytes.
+const EXPANDED_SECRET_KEY_NONCE_LENGTH: usize = 32;
+
+/// The length of an "expanded" ed25519 key, `ExpandedSecretKey`, in bytes.
+pub const EXPANDED_SECRET_KEY_LENGTH: usize =
+    EXPANDED_SECRET_KEY_KEY_LENGTH + EXPANDED_SECRET_KEY_NONCE_LENGTH;

vendor/ed25519-dalek/src/context.rs

@@ -0,0 +1,112 @@
+use crate::{InternalError, SignatureError};
+
+/// Ed25519 contexts as used by Ed25519ph.
+///
+/// Contexts are domain separator strings that can be used to isolate uses of
+/// the algorithm between different protocols (which is very hard to reliably do
+/// otherwise) and between different uses within the same protocol.
+///
+/// To create a context, call either of the following:
+///
+/// - [`SigningKey::with_context`](crate::SigningKey::with_context)
+/// - [`VerifyingKey::with_context`](crate::VerifyingKey::with_context)
+///
+/// For more information, see [RFC8032 § 8.3](https://www.rfc-editor.org/rfc/rfc8032#section-8.3).
+///
+/// # Example
+///
+#[cfg_attr(all(feature = "digest", feature = "rand_core"), doc = "```")]
+#[cfg_attr(
+    any(not(feature = "digest"), not(feature = "rand_core")),
+    doc = "```ignore"
+)]
+/// # fn main() {
+/// use ed25519_dalek::{Signature, SigningKey, VerifyingKey, Sha512};
+/// # use curve25519_dalek::digest::Digest;
+/// # use rand::rngs::OsRng;
+/// use ed25519_dalek::{DigestSigner, DigestVerifier};
+///
+/// # let mut csprng = OsRng;
+/// # let signing_key = SigningKey::generate(&mut csprng);
+/// # let verifying_key = signing_key.verifying_key();
+/// let context_str = b"Local Channel 3";
+/// let prehashed_message = Sha512::default().chain_update(b"Stay tuned for more news at 7");
+///
+/// // Signer
+/// let signing_context = signing_key.with_context(context_str).unwrap();
+/// let signature = signing_context.sign_digest(prehashed_message.clone());
+///
+/// // Verifier
+/// let verifying_context = verifying_key.with_context(context_str).unwrap();
+/// let verified: bool = verifying_context
+///     .verify_digest(prehashed_message, &signature)
+///     .is_ok();
+///
+/// # assert!(verified);
+/// # }
+/// ```
+#[derive(Clone, Debug)]
+pub struct Context<'k, 'v, K> {
+    /// Key this context is being used with.
+    key: &'k K,
+
+    /// Context value: a bytestring no longer than 255 octets.
+    value: &'v [u8],
+}
+
+impl<'k, 'v, K> Context<'k, 'v, K> {
+    /// Maximum length of the context value in octets.
+    pub const MAX_LENGTH: usize = 255;
+
+    /// Create a new Ed25519ph context.
+    pub(crate) fn new(key: &'k K, value: &'v [u8]) -> Result<Self, SignatureError> {
+        if value.len() <= Self::MAX_LENGTH {
+            Ok(Self { key, value })
+        } else {
+            Err(SignatureError::from(InternalError::PrehashedContextLength))
+        }
+    }
+
+    /// Borrow the key.
+    pub fn key(&self) -> &'k K {
+        self.key
+    }
+
+    /// Borrow the context string value.
+    pub fn value(&self) -> &'v [u8] {
+        self.value
+    }
+}
+
+#[cfg(all(test, feature = "digest"))]
+mod test {
+    #![allow(clippy::unwrap_used)]
+
+    use crate::{Signature, SigningKey, VerifyingKey};
+    use curve25519_dalek::digest::Digest;
+    use ed25519::signature::{DigestSigner, DigestVerifier};
+    use rand::rngs::OsRng;
+    use sha2::Sha512;
+
+    #[test]
+    fn context_correctness() {
+        let mut csprng = OsRng;
+        let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+        let verifying_key: VerifyingKey = signing_key.verifying_key();
+
+        let context_str = b"Local Channel 3";
+        let prehashed_message = Sha512::default().chain_update(b"Stay tuned for more news at 7");
+
+        // Signer
+        let signing_context = signing_key.with_context(context_str).unwrap();
+        let signature: Signature = signing_context.sign_digest(prehashed_message.clone());
+
+        // Verifier
+        let verifying_context = verifying_key.with_context(context_str).unwrap();
+        let verified: bool = verifying_context
+            .verify_digest(prehashed_message, &signature)
+            .is_ok();
+
+        assert!(verified);
+    }
+}

vendor/ed25519-dalek/src/errors.rs

@@ -0,0 +1,119 @@
+// -*- mode: rust; -*-
+//
+// This file is part of ed25519-dalek.
+// Copyright (c) 2017-2019 isis lovecruft
+// See LICENSE for licensing information.
+//
+// Authors:
+// - isis agora lovecruft <isis@patternsinthevoid.net>
+
+//! Errors which may occur when parsing keys and/or signatures to or from wire formats.
+
+// rustc seems to think the typenames in match statements (e.g. in
+// Display) should be snake cased, for some reason.
+#![allow(non_snake_case)]
+
+use core::fmt;
+use core::fmt::Display;
+
+#[cfg(feature = "std")]
+use std::error::Error;
+
+/// Internal errors.  Most application-level developers will likely not
+/// need to pay any attention to these.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash)]
+pub(crate) enum InternalError {
+    PointDecompression,
+    ScalarFormat,
+    /// An error in the length of bytes handed to a constructor.
+    ///
+    /// To use this, pass a string specifying the `name` of the type which is
+    /// returning the error, and the `length` in bytes which its constructor
+    /// expects.
+    BytesLength {
+        name: &'static str,
+        length: usize,
+    },
+    /// The verification equation wasn't satisfied
+    Verify,
+    /// Two arrays did not match in size, making the called signature
+    /// verification method impossible.
+    #[cfg(feature = "batch")]
+    ArrayLength {
+        name_a: &'static str,
+        length_a: usize,
+        name_b: &'static str,
+        length_b: usize,
+        name_c: &'static str,
+        length_c: usize,
+    },
+    /// An ed25519ph signature can only take up to 255 octets of context.
+    #[cfg(feature = "digest")]
+    PrehashedContextLength,
+    /// A mismatched (public, secret) key pair.
+    MismatchedKeypair,
+}
+
+impl Display for InternalError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match *self {
+            InternalError::PointDecompression => write!(f, "Cannot decompress Edwards point"),
+            InternalError::ScalarFormat => write!(f, "Cannot use scalar with high-bit set"),
+            InternalError::BytesLength { name: n, length: l } => {
+                write!(f, "{} must be {} bytes in length", n, l)
+            }
+            InternalError::Verify => write!(f, "Verification equation was not satisfied"),
+            #[cfg(feature = "batch")]
+            InternalError::ArrayLength {
+                name_a: na,
+                length_a: la,
+                name_b: nb,
+                length_b: lb,
+                name_c: nc,
+                length_c: lc,
+            } => write!(
+                f,
+                "Arrays must be the same length: {} has length {},
+                              {} has length {}, {} has length {}.",
+                na, la, nb, lb, nc, lc
+            ),
+            #[cfg(feature = "digest")]
+            InternalError::PrehashedContextLength => write!(
+                f,
+                "An ed25519ph signature can only take up to 255 octets of context"
+            ),
+            InternalError::MismatchedKeypair => write!(f, "Mismatched Keypair detected"),
+        }
+    }
+}
+
+#[cfg(feature = "std")]
+impl Error for InternalError {}
+
+/// Errors which may occur while processing signatures and keypairs.
+///
+/// This error may arise due to:
+///
+/// * Being given bytes with a length different to what was expected.
+///
+/// * A problem decompressing `r`, a curve point, in the `Signature`, or the
+///   curve point for a `PublicKey`.
+///
+/// * A problem with the format of `s`, a scalar, in the `Signature`.  This
+///   is only raised if the high-bit of the scalar was set.  (Scalars must
+///   only be constructed from 255-bit integers.)
+///
+/// * Failure of a signature to satisfy the verification equation.
+pub type SignatureError = ed25519::signature::Error;
+
+impl From<InternalError> for SignatureError {
+    #[cfg(not(feature = "std"))]
+    fn from(_err: InternalError) -> SignatureError {
+        SignatureError::new()
+    }
+
+    #[cfg(feature = "std")]
+    fn from(err: InternalError) -> SignatureError {
+        SignatureError::from_source(err)
+    }
+}

vendor/ed25519-dalek/src/hazmat.rs

@@ -0,0 +1,359 @@
+//! Low-level interfaces to ed25519 functions
+//!
+//! # ⚠️ Warning: Hazmat
+//!
+//! These primitives are easy-to-misuse low-level interfaces.
+//!
+//! If you are an end user / non-expert in cryptography, **do not use any of these functions**.
+//! Failure to use them correctly can lead to catastrophic failures including **full private key
+//! recovery.**
+
+// Permit dead code because 1) this module is only public when the `hazmat` feature is set, and 2)
+// even without `hazmat` we still need this module because this is where `ExpandedSecretKey` is
+// defined.
+#![allow(dead_code)]
+
+use core::fmt::Debug;
+
+use crate::{InternalError, SignatureError};
+
+use curve25519_dalek::scalar::{clamp_integer, Scalar};
+
+use subtle::{Choice, ConstantTimeEq};
+#[cfg(feature = "zeroize")]
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+// These are used in the functions that are made public when the hazmat feature is set
+use crate::{Signature, VerifyingKey};
+use curve25519_dalek::digest::{generic_array::typenum::U64, Digest};
+
+/// Contains the secret scalar and domain separator used for generating signatures.
+///
+/// This is used internally for signing.
+///
+/// In the usual Ed25519 signing algorithm, `scalar` and `hash_prefix` are defined such that
+/// `scalar || hash_prefix = H(sk)` where `sk` is the signing key and `H` is SHA-512.
+/// **WARNING:** Deriving the values for these fields in any other way can lead to full key
+/// recovery, as documented in [`raw_sign`] and [`raw_sign_prehashed`].
+///
+/// Instances of this secret are automatically overwritten with zeroes when they fall out of scope.
+pub struct ExpandedSecretKey {
+    /// The secret scalar used for signing
+    pub scalar: Scalar,
+    /// The domain separator used when hashing the message to generate the pseudorandom `r` value
+    pub hash_prefix: [u8; 32],
+}
+
+impl Debug for ExpandedSecretKey {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        f.debug_struct("ExpandedSecretKey").finish_non_exhaustive() // avoids printing secrets
+    }
+}
+
+impl ConstantTimeEq for ExpandedSecretKey {
+    fn ct_eq(&self, other: &Self) -> Choice {
+        self.scalar.ct_eq(&other.scalar) & self.hash_prefix.ct_eq(&other.hash_prefix)
+    }
+}
+
+impl PartialEq for ExpandedSecretKey {
+    fn eq(&self, other: &Self) -> bool {
+        self.ct_eq(other).into()
+    }
+}
+
+impl Eq for ExpandedSecretKey {}
+
+#[cfg(feature = "zeroize")]
+impl Drop for ExpandedSecretKey {
+    fn drop(&mut self) {
+        self.scalar.zeroize();
+        self.hash_prefix.zeroize()
+    }
+}
+
+#[cfg(feature = "zeroize")]
+impl ZeroizeOnDrop for ExpandedSecretKey {}
+
+// Some conversion methods for `ExpandedSecretKey`. The signing methods are defined in
+// `signing.rs`, since we need them even when `not(feature = "hazmat")`
+impl ExpandedSecretKey {
+    /// Construct an `ExpandedSecretKey` from an array of 64 bytes. In the spec, the bytes are the
+    /// output of a SHA-512 hash. This clamps the first 32 bytes and uses it as a scalar, and uses
+    /// the second 32 bytes as a domain separator for hashing.
+    pub fn from_bytes(bytes: &[u8; 64]) -> Self {
+        // TODO: Use bytes.split_array_ref once it’s in MSRV.
+        let mut scalar_bytes: [u8; 32] = [0u8; 32];
+        let mut hash_prefix: [u8; 32] = [0u8; 32];
+        scalar_bytes.copy_from_slice(&bytes[00..32]);
+        hash_prefix.copy_from_slice(&bytes[32..64]);
+
+        // For signing, we'll need the integer, clamped, and converted to a Scalar. See
+        // PureEdDSA.keygen in RFC 8032 Appendix A.
+        let scalar = Scalar::from_bytes_mod_order(clamp_integer(scalar_bytes));
+
+        ExpandedSecretKey {
+            scalar,
+            hash_prefix,
+        }
+    }
+
+    /// Construct an `ExpandedSecretKey` from a slice of 64 bytes.
+    ///
+    /// # Returns
+    ///
+    /// A `Result` whose okay value is an EdDSA `ExpandedSecretKey` or whose error value is an
+    /// `SignatureError` describing the error that occurred, namely that the given slice's length
+    /// is not 64.
+    pub fn from_slice(bytes: &[u8]) -> Result<Self, SignatureError> {
+        // Try to coerce bytes to a [u8; 64]
+        bytes.try_into().map(Self::from_bytes).map_err(|_| {
+            InternalError::BytesLength {
+                name: "ExpandedSecretKey",
+                length: 64,
+            }
+            .into()
+        })
+    }
+}
+
+impl TryFrom<&[u8]> for ExpandedSecretKey {
+    type Error = SignatureError;
+
+    fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
+        Self::from_slice(bytes)
+    }
+}
+
+/// Compute an ordinary Ed25519 signature over the given message. `CtxDigest` is the digest used to
+/// calculate the pseudorandomness needed for signing. According to the Ed25519 spec, `CtxDigest =
+/// Sha512`.
+///
+/// # ⚠️  Cryptographically Unsafe
+///
+/// Do NOT use this function unless you absolutely must. Using the wrong values in
+/// `ExpandedSecretKey` can leak your signing key. See
+/// [here](https://github.com/MystenLabs/ed25519-unsafe-libs) for more details on this attack.
+pub fn raw_sign<CtxDigest>(
+    esk: &ExpandedSecretKey,
+    message: &[u8],
+    verifying_key: &VerifyingKey,
+) -> Signature
+where
+    CtxDigest: Digest<OutputSize = U64>,
+{
+    esk.raw_sign::<CtxDigest>(message, verifying_key)
+}
+
+/// Compute a signature over the given prehashed message, the Ed25519ph algorithm defined in
+/// [RFC8032 §5.1][rfc8032]. `MsgDigest` is the digest function used to hash the signed message.
+/// `CtxDigest` is the digest function used to calculate the pseudorandomness needed for signing.
+/// According to the Ed25519 spec, `MsgDigest = CtxDigest = Sha512`.
+///
+/// # ⚠️  Cryptographically Unsafe
+//
+/// Do NOT use this function unless you absolutely must. Using the wrong values in
+/// `ExpandedSecretKey` can leak your signing key. See
+/// [here](https://github.com/MystenLabs/ed25519-unsafe-libs) for more details on this attack.
+///
+/// # Inputs
+///
+/// * `esk` is the [`ExpandedSecretKey`] being used for signing
+/// * `prehashed_message` is an instantiated hash digest with 512-bits of
+///   output which has had the message to be signed previously fed into its
+///   state.
+/// * `verifying_key` is a [`VerifyingKey`] which corresponds to this secret key.
+/// * `context` is an optional context string, up to 255 bytes inclusive,
+///   which may be used to provide additional domain separation.  If not
+///   set, this will default to an empty string.
+///
+/// `scalar` and `hash_prefix` are usually selected such that `scalar || hash_prefix = H(sk)` where
+/// `sk` is the signing key
+///
+/// # Returns
+///
+/// A `Result` whose `Ok` value is an Ed25519ph [`Signature`] on the
+/// `prehashed_message` if the context was 255 bytes or less, otherwise
+/// a `SignatureError`.
+///
+/// [rfc8032]: https://tools.ietf.org/html/rfc8032#section-5.1
+#[cfg(feature = "digest")]
+#[allow(non_snake_case)]
+pub fn raw_sign_prehashed<CtxDigest, MsgDigest>(
+    esk: &ExpandedSecretKey,
+    prehashed_message: MsgDigest,
+    verifying_key: &VerifyingKey,
+    context: Option<&[u8]>,
+) -> Result<Signature, SignatureError>
+where
+    MsgDigest: Digest<OutputSize = U64>,
+    CtxDigest: Digest<OutputSize = U64>,
+{
+    esk.raw_sign_prehashed::<CtxDigest, MsgDigest>(prehashed_message, verifying_key, context)
+}
+
+/// Compute an ordinary Ed25519 signature, with the message contents provided incrementally by
+/// updating a digest instance.
+///
+/// The `msg_update` closure provides the message content, updating a hasher argument. It will be
+/// called twice. This closure MUST leave its hasher in the same state (i.e., must hash the same
+/// values) after both calls. Otherwise it will produce an invalid signature.
+///
+/// `CtxDigest` is the digest used to calculate the pseudorandomness needed for signing. According
+/// to the Ed25519 spec, `CtxDigest = Sha512`.
+///
+/// # ⚠️  Cryptographically Unsafe
+///
+/// Do NOT use this function unless you absolutely must. Using the wrong values in
+/// `ExpandedSecretKey` can leak your signing key. See
+/// [here](https://github.com/MystenLabs/ed25519-unsafe-libs) for more details on this attack.
+pub fn raw_sign_byupdate<CtxDigest, F>(
+    esk: &ExpandedSecretKey,
+    msg_update: F,
+    verifying_key: &VerifyingKey,
+) -> Result<Signature, SignatureError>
+where
+    CtxDigest: Digest<OutputSize = U64>,
+    F: Fn(&mut CtxDigest) -> Result<(), SignatureError>,
+{
+    esk.raw_sign_byupdate::<CtxDigest, F>(msg_update, verifying_key)
+}
+
+/// The ordinary non-batched Ed25519 verification check, rejecting non-canonical R
+/// values.`CtxDigest` is the digest used to calculate the pseudorandomness needed for signing.
+/// According to the Ed25519 spec, `CtxDigest = Sha512`.
+pub fn raw_verify<CtxDigest>(
+    vk: &VerifyingKey,
+    message: &[u8],
+    signature: &ed25519::Signature,
+) -> Result<(), SignatureError>
+where
+    CtxDigest: Digest<OutputSize = U64>,
+{
+    vk.raw_verify::<CtxDigest>(message, signature)
+}
+
+/// The batched Ed25519 verification check, rejecting non-canonical R values. `MsgDigest` is the
+/// digest used to hash the signed message. `CtxDigest` is the digest used to calculate the
+/// pseudorandomness needed for signing. According to the Ed25519 spec, `MsgDigest = CtxDigest =
+/// Sha512`.
+#[cfg(feature = "digest")]
+#[allow(non_snake_case)]
+pub fn raw_verify_prehashed<CtxDigest, MsgDigest>(
+    vk: &VerifyingKey,
+    prehashed_message: MsgDigest,
+    context: Option<&[u8]>,
+    signature: &ed25519::Signature,
+) -> Result<(), SignatureError>
+where
+    MsgDigest: Digest<OutputSize = U64>,
+    CtxDigest: Digest<OutputSize = U64>,
+{
+    vk.raw_verify_prehashed::<CtxDigest, MsgDigest>(prehashed_message, context, signature)
+}
+
+#[cfg(test)]
+mod test {
+    #![allow(clippy::unwrap_used)]
+
+    use super::*;
+
+    use rand::{rngs::OsRng, CryptoRng, RngCore};
+
+    // Pick distinct, non-spec 512-bit hash functions for message and sig-context hashing
+    type CtxDigest = blake2::Blake2b512;
+    type MsgDigest = sha3::Sha3_512;
+
+    impl ExpandedSecretKey {
+        // Make a random expanded secret key for testing purposes. This is NOT how you generate
+        // expanded secret keys IRL. They're the hash of a seed.
+        fn random<R: RngCore + CryptoRng>(mut rng: R) -> Self {
+            let mut bytes = [0u8; 64];
+            rng.fill_bytes(&mut bytes);
+            ExpandedSecretKey::from_bytes(&bytes)
+        }
+    }
+
+    // Check that raw_sign and raw_verify work when a non-spec CtxDigest is used
+    #[test]
+    fn sign_verify_nonspec() {
+        // Generate the keypair
+        let rng = OsRng;
+        let esk = ExpandedSecretKey::random(rng);
+        let vk = VerifyingKey::from(&esk);
+
+        let msg = b"Then one day, a piano fell on my head";
+
+        // Sign and verify
+        let sig = raw_sign::<CtxDigest>(&esk, msg, &vk);
+        raw_verify::<CtxDigest>(&vk, msg, &sig).unwrap();
+    }
+
+    // Check that raw_sign_prehashed and raw_verify_prehashed work when distinct, non-spec
+    // MsgDigest and CtxDigest are used
+    #[cfg(feature = "digest")]
+    #[test]
+    fn sign_verify_prehashed_nonspec() {
+        use curve25519_dalek::digest::Digest;
+
+        // Generate the keypair
+        let rng = OsRng;
+        let esk = ExpandedSecretKey::random(rng);
+        let vk = VerifyingKey::from(&esk);
+
+        // Hash the message
+        let msg = b"And then I got trampled by a herd of buffalo";
+        let mut h = MsgDigest::new();
+        h.update(msg);
+
+        let ctx_str = &b"consequences"[..];
+
+        // Sign and verify prehashed
+        let sig = raw_sign_prehashed::<CtxDigest, MsgDigest>(&esk, h.clone(), &vk, Some(ctx_str))
+            .unwrap();
+        raw_verify_prehashed::<CtxDigest, MsgDigest>(&vk, h, Some(ctx_str), &sig).unwrap();
+    }
+
+    #[test]
+    fn sign_byupdate() {
+        // Generate the keypair
+        let rng = OsRng;
+        let esk = ExpandedSecretKey::random(rng);
+        let vk = VerifyingKey::from(&esk);
+
+        let msg = b"realistic";
+        // signatures are deterministic so we can compare with a good one
+        let good_sig = raw_sign::<CtxDigest>(&esk, msg, &vk);
+
+        let sig = raw_sign_byupdate::<CtxDigest, _>(
+            &esk,
+            |h| {
+                h.update(msg);
+                Ok(())
+            },
+            &vk,
+        );
+        assert!(sig.unwrap() == good_sig, "sign byupdate matches");
+
+        let sig = raw_sign_byupdate::<CtxDigest, _>(
+            &esk,
+            |h| {
+                h.update(msg);
+                Err(SignatureError::new())
+            },
+            &vk,
+        );
+        assert!(sig.is_err(), "sign byupdate failure propagates");
+
+        let sig = raw_sign_byupdate::<CtxDigest, _>(
+            &esk,
+            |h| {
+                h.update(&msg[..1]);
+                h.update(&msg[1..]);
+                Ok(())
+            },
+            &vk,
+        );
+        assert!(sig.unwrap() == good_sig, "sign byupdate two part");
+    }
+}

vendor/ed25519-dalek/src/lib.rs

@@ -0,0 +1,294 @@
+// -*- mode: rust; -*-
+//
+// This file is part of ed25519-dalek.
+// Copyright (c) 2017-2019 isis lovecruft
+// See LICENSE for licensing information.
+//
+// Authors:
+// - isis agora lovecruft <isis@patternsinthevoid.net>
+
+//! A Rust implementation of ed25519 key generation, signing, and verification.
+//!
+//! # Example
+//!
+//! Creating an ed25519 signature on a message is simple.
+//!
+//! First, we need to generate a `SigningKey`, which includes both public and
+//! secret halves of an asymmetric key.  To do so, we need a cryptographically
+//! secure pseudorandom number generator (CSPRNG). For this example, we'll use
+//! the operating system's builtin PRNG:
+//!
+#![cfg_attr(feature = "rand_core", doc = "```")]
+#![cfg_attr(not(feature = "rand_core"), doc = "```ignore")]
+//! # fn main() {
+//! // $ cargo add ed25519_dalek --features rand_core
+//! use rand::rngs::OsRng;
+//! use ed25519_dalek::SigningKey;
+//! use ed25519_dalek::Signature;
+//!
+//! let mut csprng = OsRng;
+//! let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+//! # }
+//! ```
+//!
+//! We can now use this `signing_key` to sign a message:
+//!
+#![cfg_attr(feature = "rand_core", doc = "```")]
+#![cfg_attr(not(feature = "rand_core"), doc = "```ignore")]
+//! # fn main() {
+//! # use rand::rngs::OsRng;
+//! # use ed25519_dalek::SigningKey;
+//! # let mut csprng = OsRng;
+//! # let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+//! use ed25519_dalek::{Signature, Signer};
+//! let message: &[u8] = b"This is a test of the tsunami alert system.";
+//! let signature: Signature = signing_key.sign(message);
+//! # }
+//! ```
+//!
+//! As well as to verify that this is, indeed, a valid signature on
+//! that `message`:
+//!
+#![cfg_attr(feature = "rand_core", doc = "```")]
+#![cfg_attr(not(feature = "rand_core"), doc = "```ignore")]
+//! # fn main() {
+//! # use rand::rngs::OsRng;
+//! # use ed25519_dalek::{SigningKey, Signature, Signer};
+//! # let mut csprng = OsRng;
+//! # let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+//! # let message: &[u8] = b"This is a test of the tsunami alert system.";
+//! # let signature: Signature = signing_key.sign(message);
+//! use ed25519_dalek::Verifier;
+//! assert!(signing_key.verify(message, &signature).is_ok());
+//! # }
+//! ```
+//!
+//! Anyone else, given the `public` half of the `signing_key` can also easily
+//! verify this signature:
+//!
+#![cfg_attr(feature = "rand_core", doc = "```")]
+#![cfg_attr(not(feature = "rand_core"), doc = "```ignore")]
+//! # fn main() {
+//! # use rand::rngs::OsRng;
+//! # use ed25519_dalek::SigningKey;
+//! # use ed25519_dalek::Signature;
+//! # use ed25519_dalek::Signer;
+//! use ed25519_dalek::{VerifyingKey, Verifier};
+//! # let mut csprng = OsRng;
+//! # let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+//! # let message: &[u8] = b"This is a test of the tsunami alert system.";
+//! # let signature: Signature = signing_key.sign(message);
+//!
+//! let verifying_key: VerifyingKey = signing_key.verifying_key();
+//! assert!(verifying_key.verify(message, &signature).is_ok());
+//! # }
+//! ```
+//!
+//! ## Serialisation
+//!
+//! `VerifyingKey`s, `SecretKey`s, `SigningKey`s, and `Signature`s can be serialised
+//! into byte-arrays by calling `.to_bytes()`.  It's perfectly acceptable and
+//! safe to transfer and/or store those bytes.  (Of course, never transfer your
+//! secret key to anyone else, since they will only need the public key to
+//! verify your signatures!)
+//!
+#![cfg_attr(feature = "rand_core", doc = "```")]
+#![cfg_attr(not(feature = "rand_core"), doc = "```ignore")]
+//! # fn main() {
+//! # use rand::rngs::OsRng;
+//! # use ed25519_dalek::{SigningKey, Signature, Signer, VerifyingKey};
+//! use ed25519_dalek::{PUBLIC_KEY_LENGTH, SECRET_KEY_LENGTH, KEYPAIR_LENGTH, SIGNATURE_LENGTH};
+//! # let mut csprng = OsRng;
+//! # let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+//! # let message: &[u8] = b"This is a test of the tsunami alert system.";
+//! # let signature: Signature = signing_key.sign(message);
+//!
+//! let verifying_key_bytes: [u8; PUBLIC_KEY_LENGTH] = signing_key.verifying_key().to_bytes();
+//! let secret_key_bytes: [u8; SECRET_KEY_LENGTH] = signing_key.to_bytes();
+//! let signing_key_bytes:    [u8; KEYPAIR_LENGTH]    = signing_key.to_keypair_bytes();
+//! let signature_bytes:  [u8; SIGNATURE_LENGTH]  = signature.to_bytes();
+//! # }
+//! ```
+//!
+//! And similarly, decoded from bytes with `::from_bytes()`:
+//!
+#![cfg_attr(feature = "rand_core", doc = "```")]
+#![cfg_attr(not(feature = "rand_core"), doc = "```ignore")]
+//! # use core::convert::{TryFrom, TryInto};
+//! # use rand::rngs::OsRng;
+//! # use ed25519_dalek::{SigningKey, Signature, Signer, VerifyingKey, SecretKey, SignatureError};
+//! # use ed25519_dalek::{PUBLIC_KEY_LENGTH, SECRET_KEY_LENGTH, KEYPAIR_LENGTH, SIGNATURE_LENGTH};
+//! # fn do_test() -> Result<(SigningKey, VerifyingKey, Signature), SignatureError> {
+//! # let mut csprng = OsRng;
+//! # let signing_key_orig: SigningKey = SigningKey::generate(&mut csprng);
+//! # let message: &[u8] = b"This is a test of the tsunami alert system.";
+//! # let signature_orig: Signature = signing_key_orig.sign(message);
+//! # let verifying_key_bytes: [u8; PUBLIC_KEY_LENGTH] = signing_key_orig.verifying_key().to_bytes();
+//! # let signing_key_bytes: [u8; SECRET_KEY_LENGTH] = signing_key_orig.to_bytes();
+//! # let signature_bytes:  [u8; SIGNATURE_LENGTH]  = signature_orig.to_bytes();
+//! #
+//! let verifying_key: VerifyingKey = VerifyingKey::from_bytes(&verifying_key_bytes)?;
+//! let signing_key: SigningKey = SigningKey::from_bytes(&signing_key_bytes);
+//! let signature: Signature = Signature::try_from(&signature_bytes[..])?;
+//! #
+//! # Ok((signing_key, verifying_key, signature))
+//! # }
+//! # fn main() {
+//! #     do_test();
+//! # }
+//! ```
+//!
+//! ### PKCS#8 Key Encoding
+//!
+//! PKCS#8 is a private key format with support for multiple algorithms.
+//! It can be encoded as binary (DER) or text (PEM).
+//!
+//! You can recognize PEM-encoded PKCS#8 keys by the following:
+//!
+//! ```text
+//! -----BEGIN PRIVATE KEY-----
+//! ```
+//!
+//! To use PKCS#8, you need to enable the `pkcs8` crate feature.
+//!
+//! The following traits can be used to decode/encode [`SigningKey`] and
+//! [`VerifyingKey`] as PKCS#8. Note that [`pkcs8`] is re-exported from the
+//! toplevel of the crate:
+//!
+//! - [`pkcs8::DecodePrivateKey`]: decode private keys from PKCS#8
+//! - [`pkcs8::EncodePrivateKey`]: encode private keys to PKCS#8
+//! - [`pkcs8::DecodePublicKey`]: decode public keys from PKCS#8
+//! - [`pkcs8::EncodePublicKey`]: encode public keys to PKCS#8
+//!
+//! #### Example
+//!
+//! NOTE: this requires the `pem` crate feature.
+//!
+#![cfg_attr(feature = "pem", doc = "```")]
+#![cfg_attr(not(feature = "pem"), doc = "```ignore")]
+//! use ed25519_dalek::{VerifyingKey, pkcs8::DecodePublicKey};
+//!
+//! let pem = "-----BEGIN PUBLIC KEY-----
+//! MCowBQYDK2VwAyEAGb9ECWmEzf6FQbrBZ9w7lshQhqowtrbLDFw4rXAxZuE=
+//! -----END PUBLIC KEY-----";
+//!
+//! let verifying_key = VerifyingKey::from_public_key_pem(pem)
+//!     .expect("invalid public key PEM");
+//! ```
+//!
+//! ### Using Serde
+//!
+//! If you prefer the bytes to be wrapped in another serialisation format, all
+//! types additionally come with built-in [serde](https://serde.rs) support by
+//! building `ed25519-dalek` via:
+//!
+//! ```bash
+//! $ cargo build --features="serde"
+//! ```
+//!
+//! They can be then serialised into any of the wire formats which serde supports.
+//! For example, using [bincode](https://github.com/TyOverby/bincode):
+//!
+#![cfg_attr(all(feature = "rand_core", feature = "serde"), doc = "```")]
+#![cfg_attr(not(all(feature = "rand_core", feature = "serde")), doc = "```ignore")]
+//! # fn main() {
+//! # use rand::rngs::OsRng;
+//! # use ed25519_dalek::{SigningKey, Signature, Signer, Verifier, VerifyingKey};
+//! use bincode::serialize;
+//! # let mut csprng = OsRng;
+//! # let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+//! # let message: &[u8] = b"This is a test of the tsunami alert system.";
+//! # let signature: Signature = signing_key.sign(message);
+//! # let verifying_key: VerifyingKey = signing_key.verifying_key();
+//! # let verified: bool = verifying_key.verify(message, &signature).is_ok();
+//!
+//! let encoded_verifying_key: Vec<u8> = serialize(&verifying_key).unwrap();
+//! let encoded_signature: Vec<u8> = serialize(&signature).unwrap();
+//! # }
+//! ```
+//!
+//! After sending the `encoded_verifying_key` and `encoded_signature`, the
+//! recipient may deserialise them and verify:
+//!
+#![cfg_attr(all(feature = "rand_core", feature = "serde"), doc = "```")]
+#![cfg_attr(not(all(feature = "rand_core", feature = "serde")), doc = "```ignore")]
+//! # fn main() {
+//! # use rand::rngs::OsRng;
+//! # use ed25519_dalek::{SigningKey, Signature, Signer, Verifier, VerifyingKey};
+//! # use bincode::serialize;
+//! use bincode::deserialize;
+//!
+//! # let mut csprng = OsRng;
+//! # let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+//! let message: &[u8] = b"This is a test of the tsunami alert system.";
+//! # let signature: Signature = signing_key.sign(message);
+//! # let verifying_key: VerifyingKey = signing_key.verifying_key();
+//! # let verified: bool = verifying_key.verify(message, &signature).is_ok();
+//! # let encoded_verifying_key: Vec<u8> = serialize(&verifying_key).unwrap();
+//! # let encoded_signature: Vec<u8> = serialize(&signature).unwrap();
+//! let decoded_verifying_key: VerifyingKey = deserialize(&encoded_verifying_key).unwrap();
+//! let decoded_signature: Signature = deserialize(&encoded_signature).unwrap();
+//!
+//! # assert_eq!(verifying_key, decoded_verifying_key);
+//! # assert_eq!(signature, decoded_signature);
+//! #
+//! let verified: bool = decoded_verifying_key.verify(&message, &decoded_signature).is_ok();
+//!
+//! assert!(verified);
+//! # }
+//! ```
+
+#![no_std]
+#![warn(future_incompatible, rust_2018_idioms)]
+#![deny(missing_docs)] // refuse to compile if documentation is missing
+#![deny(clippy::unwrap_used)] // don't allow unwrap
+#![cfg_attr(not(test), forbid(unsafe_code))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg, doc_cfg, doc_cfg_hide))]
+#![cfg_attr(docsrs, doc(cfg_hide(docsrs)))]
+
+#[cfg(feature = "batch")]
+extern crate alloc;
+
+#[cfg(any(feature = "std", test))]
+#[macro_use]
+extern crate std;
+
+pub use ed25519;
+
+#[cfg(feature = "batch")]
+mod batch;
+mod constants;
+#[cfg(feature = "digest")]
+mod context;
+mod errors;
+mod signature;
+mod signing;
+mod verifying;
+
+#[cfg(feature = "hazmat")]
+pub mod hazmat;
+#[cfg(not(feature = "hazmat"))]
+mod hazmat;
+
+#[cfg(feature = "digest")]
+pub use curve25519_dalek::digest::Digest;
+#[cfg(feature = "digest")]
+pub use sha2::Sha512;
+
+#[cfg(feature = "batch")]
+pub use crate::batch::*;
+pub use crate::constants::*;
+#[cfg(feature = "digest")]
+pub use crate::context::Context;
+pub use crate::errors::*;
+pub use crate::signing::*;
+pub use crate::verifying::*;
+
+// Re-export the `Signer` and `Verifier` traits from the `signature` crate
+#[cfg(feature = "digest")]
+pub use ed25519::signature::{DigestSigner, DigestVerifier};
+pub use ed25519::signature::{Signer, Verifier};
+pub use ed25519::Signature;
+
+#[cfg(feature = "pkcs8")]
+pub use ed25519::pkcs8;

vendor/ed25519-dalek/src/signature.rs

@@ -0,0 +1,177 @@
+// -*- mode: rust; -*-
+//
+// This file is part of ed25519-dalek.
+// Copyright (c) 2017-2019 isis lovecruft
+// See LICENSE for licensing information.
+//
+// Authors:
+// - isis agora lovecruft <isis@patternsinthevoid.net>
+
+//! An ed25519 signature.
+
+use core::fmt::Debug;
+
+use curve25519_dalek::edwards::CompressedEdwardsY;
+use curve25519_dalek::scalar::Scalar;
+
+use crate::constants::*;
+use crate::errors::*;
+
+/// An ed25519 signature.
+///
+/// # Note
+///
+/// These signatures, unlike the ed25519 signature reference implementation, are
+/// "detached"—that is, they do **not** include a copy of the message which has
+/// been signed.
+#[allow(non_snake_case)]
+#[derive(Copy, Eq, PartialEq)]
+pub(crate) struct InternalSignature {
+    /// `R` is an `EdwardsPoint`, formed by using an hash function with
+    /// 512-bits output to produce the digest of:
+    ///
+    /// - the nonce half of the `ExpandedSecretKey`, and
+    /// - the message to be signed.
+    ///
+    /// This digest is then interpreted as a `Scalar` and reduced into an
+    /// element in ℤ/lℤ.  The scalar is then multiplied by the distinguished
+    /// basepoint to produce `R`, and `EdwardsPoint`.
+    pub(crate) R: CompressedEdwardsY,
+
+    /// `s` is a `Scalar`, formed by using an hash function with 512-bits output
+    /// to produce the digest of:
+    ///
+    /// - the `r` portion of this `Signature`,
+    /// - the `PublicKey` which should be used to verify this `Signature`, and
+    /// - the message to be signed.
+    ///
+    /// This digest is then interpreted as a `Scalar` and reduced into an
+    /// element in ℤ/lℤ.
+    pub(crate) s: Scalar,
+}
+
+impl Clone for InternalSignature {
+    fn clone(&self) -> Self {
+        *self
+    }
+}
+
+impl Debug for InternalSignature {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(f, "Signature( R: {:?}, s: {:?} )", &self.R, &self.s)
+    }
+}
+
+/// Ensures that the scalar `s` of a signature is within the bounds [0, 2^253).
+///
+/// **Unsafe**: This version of `check_scalar` permits signature malleability. See README.
+#[cfg(feature = "legacy_compatibility")]
+#[inline(always)]
+fn check_scalar(bytes: [u8; 32]) -> Result<Scalar, SignatureError> {
+    // The highest 3 bits must not be set.  No other checking for the
+    // remaining 2^253 - 2^252 + 27742317777372353535851937790883648493
+    // potential non-reduced scalars is performed.
+    //
+    // This is compatible with ed25519-donna and libsodium when
+    // `-D ED25519_COMPAT` is NOT specified.
+    if bytes[31] & 224 != 0 {
+        return Err(InternalError::ScalarFormat.into());
+    }
+
+    // You cannot do arithmetic with scalars construct with Scalar::from_bits. We only use this
+    // scalar for EdwardsPoint::vartime_double_scalar_mul_basepoint, which is an accepted usecase.
+    // The `from_bits` method is deprecated because it's unsafe. We know this.
+    #[allow(deprecated)]
+    Ok(Scalar::from_bits(bytes))
+}
+
+/// Ensures that the scalar `s` of a signature is within the bounds [0, ℓ)
+#[cfg(not(feature = "legacy_compatibility"))]
+#[inline(always)]
+fn check_scalar(bytes: [u8; 32]) -> Result<Scalar, SignatureError> {
+    match Scalar::from_canonical_bytes(bytes).into() {
+        None => Err(InternalError::ScalarFormat.into()),
+        Some(x) => Ok(x),
+    }
+}
+
+impl InternalSignature {
+    /// Construct a `Signature` from a slice of bytes.
+    ///
+    /// # Scalar Malleability Checking
+    ///
+    /// As originally specified in the ed25519 paper (cf. the "Malleability"
+    /// section of the README in this repo), no checks whatsoever were performed
+    /// for signature malleability.
+    ///
+    /// Later, a semi-functional, hacky check was added to most libraries to
+    /// "ensure" that the scalar portion, `s`, of the signature was reduced `mod
+    /// \ell`, the order of the basepoint:
+    ///
+    /// ```ignore
+    /// if signature.s[31] & 224 != 0 {
+    ///     return Err();
+    /// }
+    /// ```
+    ///
+    /// This bit-twiddling ensures that the most significant three bits of the
+    /// scalar are not set:
+    ///
+    /// ```python,ignore
+    /// >>> 0b00010000 & 224
+    /// 0
+    /// >>> 0b00100000 & 224
+    /// 32
+    /// >>> 0b01000000 & 224
+    /// 64
+    /// >>> 0b10000000 & 224
+    /// 128
+    /// ```
+    ///
+    /// However, this check is hacky and insufficient to check that the scalar is
+    /// fully reduced `mod \ell = 2^252 + 27742317777372353535851937790883648493` as
+    /// it leaves us with a guanteed bound of 253 bits.  This means that there are
+    /// `2^253 - 2^252 + 2774231777737235353585193779088364849311` remaining scalars
+    /// which could cause malleabilllity.
+    ///
+    /// RFC8032 [states](https://tools.ietf.org/html/rfc8032#section-5.1.7):
+    ///
+    /// > To verify a signature on a message M using public key A, [...]
+    /// > first split the signature into two 32-octet halves.  Decode the first
+    /// > half as a point R, and the second half as an integer S, in the range
+    /// > 0 <= s < L.  Decode the public key A as point A'.  If any of the
+    /// > decodings fail (including S being out of range), the signature is
+    /// > invalid.
+    ///
+    /// However, by the time this was standardised, most libraries in use were
+    /// only checking the most significant three bits.  (See also the
+    /// documentation for [`crate::VerifyingKey::verify_strict`].)
+    #[inline]
+    #[allow(non_snake_case)]
+    pub fn from_bytes(bytes: &[u8; SIGNATURE_LENGTH]) -> Result<InternalSignature, SignatureError> {
+        // TODO: Use bytes.split_array_ref once it’s in MSRV.
+        let mut R_bytes: [u8; 32] = [0u8; 32];
+        let mut s_bytes: [u8; 32] = [0u8; 32];
+        R_bytes.copy_from_slice(&bytes[00..32]);
+        s_bytes.copy_from_slice(&bytes[32..64]);
+
+        Ok(InternalSignature {
+            R: CompressedEdwardsY(R_bytes),
+            s: check_scalar(s_bytes)?,
+        })
+    }
+}
+
+impl TryFrom<&ed25519::Signature> for InternalSignature {
+    type Error = SignatureError;
+
+    fn try_from(sig: &ed25519::Signature) -> Result<InternalSignature, SignatureError> {
+        InternalSignature::from_bytes(&sig.to_bytes())
+    }
+}
+
+impl From<InternalSignature> for ed25519::Signature {
+    fn from(sig: InternalSignature) -> ed25519::Signature {
+        ed25519::Signature::from_components(*sig.R.as_bytes(), *sig.s.as_bytes())
+    }
+}

vendor/ed25519-dalek/src/signing.rs

@@ -0,0 +1,955 @@
+// -*- mode: rust; -*-
+//
+// This file is part of ed25519-dalek.
+// Copyright (c) 2017-2019 isis lovecruft
+// See LICENSE for licensing information.
+//
+// Authors:
+// - isis agora lovecruft <isis@patternsinthevoid.net>
+
+//! ed25519 signing keys.
+
+use core::fmt::Debug;
+
+#[cfg(feature = "pkcs8")]
+use ed25519::pkcs8;
+
+#[cfg(any(test, feature = "rand_core"))]
+use rand_core::CryptoRngCore;
+
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+use sha2::Sha512;
+use subtle::{Choice, ConstantTimeEq};
+
+use curve25519_dalek::{
+    digest::{generic_array::typenum::U64, Digest},
+    edwards::{CompressedEdwardsY, EdwardsPoint},
+    scalar::Scalar,
+};
+
+use ed25519::signature::{KeypairRef, Signer, Verifier};
+
+#[cfg(feature = "digest")]
+use crate::context::Context;
+#[cfg(feature = "digest")]
+use signature::DigestSigner;
+
+#[cfg(feature = "zeroize")]
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+#[cfg(feature = "hazmat")]
+use crate::verifying::StreamVerifier;
+use crate::{
+    constants::{KEYPAIR_LENGTH, SECRET_KEY_LENGTH},
+    errors::{InternalError, SignatureError},
+    hazmat::ExpandedSecretKey,
+    signature::InternalSignature,
+    verifying::VerifyingKey,
+    Signature,
+};
+
+/// ed25519 secret key as defined in [RFC8032 § 5.1.5]:
+///
+/// > The private key is 32 octets (256 bits, corresponding to b) of
+/// > cryptographically secure random data.
+///
+/// [RFC8032 § 5.1.5]: https://www.rfc-editor.org/rfc/rfc8032#section-5.1.5
+pub type SecretKey = [u8; SECRET_KEY_LENGTH];
+
+/// ed25519 signing key which can be used to produce signatures.
+// Invariant: `verifying_key` is always the public key of
+// `secret_key`. This prevents the signing function oracle attack
+// described in https://github.com/MystenLabs/ed25519-unsafe-libs
+#[derive(Clone)]
+pub struct SigningKey {
+    /// The secret half of this signing key.
+    pub(crate) secret_key: SecretKey,
+    /// The public half of this signing key.
+    pub(crate) verifying_key: VerifyingKey,
+}
+
+/// # Example
+///
+/// ```
+/// # extern crate ed25519_dalek;
+/// #
+/// use ed25519_dalek::SigningKey;
+/// use ed25519_dalek::SECRET_KEY_LENGTH;
+/// use ed25519_dalek::SignatureError;
+///
+/// # fn doctest() -> Result<SigningKey, SignatureError> {
+/// let secret_key_bytes: [u8; SECRET_KEY_LENGTH] = [
+///    157, 097, 177, 157, 239, 253, 090, 096,
+///    186, 132, 074, 244, 146, 236, 044, 196,
+///    068, 073, 197, 105, 123, 050, 105, 025,
+///    112, 059, 172, 003, 028, 174, 127, 096, ];
+///
+/// let signing_key: SigningKey = SigningKey::from_bytes(&secret_key_bytes);
+/// assert_eq!(signing_key.to_bytes(), secret_key_bytes);
+///
+/// # Ok(signing_key)
+/// # }
+/// #
+/// # fn main() {
+/// #     let result = doctest();
+/// #     assert!(result.is_ok());
+/// # }
+/// ```
+impl SigningKey {
+    /// Construct a [`SigningKey`] from a [`SecretKey`]
+    ///
+    #[inline]
+    pub fn from_bytes(secret_key: &SecretKey) -> Self {
+        let verifying_key = VerifyingKey::from(&ExpandedSecretKey::from(secret_key));
+        Self {
+            secret_key: *secret_key,
+            verifying_key,
+        }
+    }
+
+    /// Convert this [`SigningKey`] into a [`SecretKey`]
+    #[inline]
+    pub fn to_bytes(&self) -> SecretKey {
+        self.secret_key
+    }
+
+    /// Convert this [`SigningKey`] into a [`SecretKey`] reference
+    #[inline]
+    pub fn as_bytes(&self) -> &SecretKey {
+        &self.secret_key
+    }
+
+    /// Construct a [`SigningKey`] from the bytes of a `VerifyingKey` and `SecretKey`.
+    ///
+    /// # Inputs
+    ///
+    /// * `bytes`: an `&[u8]` of length [`KEYPAIR_LENGTH`], representing the
+    ///   scalar for the secret key, and a compressed Edwards-Y coordinate of a
+    ///   point on curve25519, both as bytes. (As obtained from
+    ///   [`SigningKey::to_bytes`].)
+    ///
+    /// # Returns
+    ///
+    /// A `Result` whose okay value is an EdDSA [`SigningKey`] or whose error value
+    /// is a `SignatureError` describing the error that occurred.
+    #[inline]
+    pub fn from_keypair_bytes(bytes: &[u8; 64]) -> Result<SigningKey, SignatureError> {
+        let (secret_key, verifying_key) = bytes.split_at(SECRET_KEY_LENGTH);
+        let signing_key = SigningKey::try_from(secret_key)?;
+        let verifying_key = VerifyingKey::try_from(verifying_key)?;
+
+        if signing_key.verifying_key() != verifying_key {
+            return Err(InternalError::MismatchedKeypair.into());
+        }
+
+        Ok(signing_key)
+    }
+
+    /// Convert this signing key to a 64-byte keypair.
+    ///
+    /// # Returns
+    ///
+    /// An array of bytes, `[u8; KEYPAIR_LENGTH]`.  The first
+    /// `SECRET_KEY_LENGTH` of bytes is the `SecretKey`, and the next
+    /// `PUBLIC_KEY_LENGTH` bytes is the `VerifyingKey` (the same as other
+    /// libraries, such as [Adam Langley's ed25519 Golang
+    /// implementation](https://github.com/agl/ed25519/)). It is guaranteed that
+    /// the encoded public key is the one derived from the encoded secret key.
+    pub fn to_keypair_bytes(&self) -> [u8; KEYPAIR_LENGTH] {
+        let mut bytes: [u8; KEYPAIR_LENGTH] = [0u8; KEYPAIR_LENGTH];
+
+        bytes[..SECRET_KEY_LENGTH].copy_from_slice(&self.secret_key);
+        bytes[SECRET_KEY_LENGTH..].copy_from_slice(self.verifying_key.as_bytes());
+        bytes
+    }
+
+    /// Get the [`VerifyingKey`] for this [`SigningKey`].
+    pub fn verifying_key(&self) -> VerifyingKey {
+        self.verifying_key
+    }
+
+    /// Create a signing context that can be used for Ed25519ph with
+    /// [`DigestSigner`].
+    #[cfg(feature = "digest")]
+    pub fn with_context<'k, 'v>(
+        &'k self,
+        context_value: &'v [u8],
+    ) -> Result<Context<'k, 'v, Self>, SignatureError> {
+        Context::new(self, context_value)
+    }
+
+    /// Generate an ed25519 signing key.
+    ///
+    /// # Example
+    ///
+    #[cfg_attr(feature = "rand_core", doc = "```")]
+    #[cfg_attr(not(feature = "rand_core"), doc = "```ignore")]
+    /// # fn main() {
+    /// use rand::rngs::OsRng;
+    /// use ed25519_dalek::{Signature, SigningKey};
+    ///
+    /// let mut csprng = OsRng;
+    /// let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+    /// # }
+    /// ```
+    ///
+    /// # Input
+    ///
+    /// A CSPRNG with a `fill_bytes()` method, e.g. `rand_os::OsRng`.
+    #[cfg(any(test, feature = "rand_core"))]
+    pub fn generate<R: CryptoRngCore + ?Sized>(csprng: &mut R) -> SigningKey {
+        let mut secret = SecretKey::default();
+        csprng.fill_bytes(&mut secret);
+        Self::from_bytes(&secret)
+    }
+
+    /// Sign a `prehashed_message` with this [`SigningKey`] using the
+    /// Ed25519ph algorithm defined in [RFC8032 §5.1][rfc8032].
+    ///
+    /// # Inputs
+    ///
+    /// * `prehashed_message` is an instantiated hash digest with 512-bits of
+    ///   output which has had the message to be signed previously fed into its
+    ///   state.
+    /// * `context` is an optional context string, up to 255 bytes inclusive,
+    ///   which may be used to provide additional domain separation.  If not
+    ///   set, this will default to an empty string.
+    ///
+    /// # Returns
+    ///
+    /// An Ed25519ph [`Signature`] on the `prehashed_message`.
+    ///
+    /// # Note
+    ///
+    /// The RFC only permits SHA-512 to be used for prehashing, i.e., `MsgDigest = Sha512`. This
+    /// function technically works, and is probably safe to use, with any secure hash function with
+    /// 512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose
+    /// [`crate::Sha512`] for user convenience.
+    ///
+    /// # Examples
+    ///
+    #[cfg_attr(all(feature = "rand_core", feature = "digest"), doc = "```")]
+    #[cfg_attr(
+        any(not(feature = "rand_core"), not(feature = "digest")),
+        doc = "```ignore"
+    )]
+    /// use ed25519_dalek::Digest;
+    /// use ed25519_dalek::SigningKey;
+    /// use ed25519_dalek::Signature;
+    /// use sha2::Sha512;
+    /// use rand::rngs::OsRng;
+    ///
+    /// # fn main() {
+    /// let mut csprng = OsRng;
+    /// let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+    /// let message: &[u8] = b"All I want is to pet all of the dogs.";
+    ///
+    /// // Create a hash digest object which we'll feed the message into:
+    /// let mut prehashed: Sha512 = Sha512::new();
+    ///
+    /// prehashed.update(message);
+    /// # }
+    /// ```
+    ///
+    /// If you want, you can optionally pass a "context".  It is generally a
+    /// good idea to choose a context and try to make it unique to your project
+    /// and this specific usage of signatures.
+    ///
+    /// For example, without this, if you were to [convert your OpenPGP key
+    /// to a Bitcoin key][terrible_idea] (just as an example, and also Don't
+    /// Ever Do That) and someone tricked you into signing an "email" which was
+    /// actually a Bitcoin transaction moving all your magic internet money to
+    /// their address, it'd be a valid transaction.
+    ///
+    /// By adding a context, this trick becomes impossible, because the context
+    /// is concatenated into the hash, which is then signed.  So, going with the
+    /// previous example, if your bitcoin wallet used a context of
+    /// "BitcoinWalletAppTxnSigning" and OpenPGP used a context (this is likely
+    /// the least of their safety problems) of "GPGsCryptoIsntConstantTimeLol",
+    /// then the signatures produced by both could never match the other, even
+    /// if they signed the exact same message with the same key.
+    ///
+    /// Let's add a context for good measure (remember, you'll want to choose
+    /// your own!):
+    ///
+    #[cfg_attr(all(feature = "rand_core", feature = "digest"), doc = "```")]
+    #[cfg_attr(
+        any(not(feature = "rand_core"), not(feature = "digest")),
+        doc = "```ignore"
+    )]
+    /// # use ed25519_dalek::Digest;
+    /// # use ed25519_dalek::SigningKey;
+    /// # use ed25519_dalek::Signature;
+    /// # use ed25519_dalek::SignatureError;
+    /// # use sha2::Sha512;
+    /// # use rand::rngs::OsRng;
+    /// #
+    /// # fn do_test() -> Result<Signature, SignatureError> {
+    /// # let mut csprng = OsRng;
+    /// # let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+    /// # let message: &[u8] = b"All I want is to pet all of the dogs.";
+    /// # let mut prehashed: Sha512 = Sha512::new();
+    /// # prehashed.update(message);
+    /// #
+    /// let context: &[u8] = b"Ed25519DalekSignPrehashedDoctest";
+    ///
+    /// let sig: Signature = signing_key.sign_prehashed(prehashed, Some(context))?;
+    /// #
+    /// # Ok(sig)
+    /// # }
+    /// # fn main() {
+    /// #     do_test();
+    /// # }
+    /// ```
+    ///
+    /// [rfc8032]: https://tools.ietf.org/html/rfc8032#section-5.1
+    /// [terrible_idea]: https://github.com/isislovecruft/scripts/blob/master/gpgkey2bc.py
+    #[cfg(feature = "digest")]
+    pub fn sign_prehashed<MsgDigest>(
+        &self,
+        prehashed_message: MsgDigest,
+        context: Option<&[u8]>,
+    ) -> Result<Signature, SignatureError>
+    where
+        MsgDigest: Digest<OutputSize = U64>,
+    {
+        ExpandedSecretKey::from(&self.secret_key).raw_sign_prehashed::<Sha512, MsgDigest>(
+            prehashed_message,
+            &self.verifying_key,
+            context,
+        )
+    }
+
+    /// Verify a signature on a message with this signing key's public key.
+    pub fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), SignatureError> {
+        self.verifying_key.verify(message, signature)
+    }
+
+    /// Verify a `signature` on a `prehashed_message` using the Ed25519ph algorithm.
+    ///
+    /// # Inputs
+    ///
+    /// * `prehashed_message` is an instantiated hash digest with 512-bits of
+    ///   output which has had the message to be signed previously fed into its
+    ///   state.
+    /// * `context` is an optional context string, up to 255 bytes inclusive,
+    ///   which may be used to provide additional domain separation.  If not
+    ///   set, this will default to an empty string.
+    /// * `signature` is a purported Ed25519ph [`Signature`] on the `prehashed_message`.
+    ///
+    /// # Returns
+    ///
+    /// Returns `true` if the `signature` was a valid signature created by this
+    /// [`SigningKey`] on the `prehashed_message`.
+    ///
+    /// # Note
+    ///
+    /// The RFC only permits SHA-512 to be used for prehashing, i.e., `MsgDigest = Sha512`. This
+    /// function technically works, and is probably safe to use, with any secure hash function with
+    /// 512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose
+    /// [`crate::Sha512`] for user convenience.
+    ///
+    /// # Examples
+    ///
+    #[cfg_attr(all(feature = "rand_core", feature = "digest"), doc = "```")]
+    #[cfg_attr(
+        any(not(feature = "rand_core"), not(feature = "digest")),
+        doc = "```ignore"
+    )]
+    /// use ed25519_dalek::Digest;
+    /// use ed25519_dalek::SigningKey;
+    /// use ed25519_dalek::Signature;
+    /// use ed25519_dalek::SignatureError;
+    /// use sha2::Sha512;
+    /// use rand::rngs::OsRng;
+    ///
+    /// # fn do_test() -> Result<(), SignatureError> {
+    /// let mut csprng = OsRng;
+    /// let signing_key: SigningKey = SigningKey::generate(&mut csprng);
+    /// let message: &[u8] = b"All I want is to pet all of the dogs.";
+    ///
+    /// let mut prehashed: Sha512 = Sha512::new();
+    /// prehashed.update(message);
+    ///
+    /// let context: &[u8] = b"Ed25519DalekSignPrehashedDoctest";
+    ///
+    /// let sig: Signature = signing_key.sign_prehashed(prehashed, Some(context))?;
+    ///
+    /// // The sha2::Sha512 struct doesn't implement Copy, so we'll have to create a new one:
+    /// let mut prehashed_again: Sha512 = Sha512::default();
+    /// prehashed_again.update(message);
+    ///
+    /// let verified = signing_key.verifying_key().verify_prehashed(prehashed_again, Some(context), &sig);
+    ///
+    /// assert!(verified.is_ok());
+    ///
+    /// # verified
+    /// # }
+    /// #
+    /// # fn main() {
+    /// #     do_test();
+    /// # }
+    /// ```
+    ///
+    /// [rfc8032]: https://tools.ietf.org/html/rfc8032#section-5.1
+    #[cfg(feature = "digest")]
+    pub fn verify_prehashed<MsgDigest>(
+        &self,
+        prehashed_message: MsgDigest,
+        context: Option<&[u8]>,
+        signature: &Signature,
+    ) -> Result<(), SignatureError>
+    where
+        MsgDigest: Digest<OutputSize = U64>,
+    {
+        self.verifying_key
+            .verify_prehashed(prehashed_message, context, signature)
+    }
+
+    /// Strictly verify a signature on a message with this signing key's public key.
+    ///
+    /// # On The (Multiple) Sources of Malleability in Ed25519 Signatures
+    ///
+    /// This version of verification is technically non-RFC8032 compliant.  The
+    /// following explains why.
+    ///
+    /// 1. Scalar Malleability
+    ///
+    /// The authors of the RFC explicitly stated that verification of an ed25519
+    /// signature must fail if the scalar `s` is not properly reduced mod \ell:
+    ///
+    /// > To verify a signature on a message M using public key A, with F
+    /// > being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or
+    /// > Ed25519ph is being used, C being the context, first split the
+    /// > signature into two 32-octet halves.  Decode the first half as a
+    /// > point R, and the second half as an integer S, in the range
+    /// > 0 <= s < L.  Decode the public key A as point A'.  If any of the
+    /// > decodings fail (including S being out of range), the signature is
+    /// > invalid.)
+    ///
+    /// All `verify_*()` functions within ed25519-dalek perform this check.
+    ///
+    /// 2. Point malleability
+    ///
+    /// The authors of the RFC added in a malleability check to step #3 in
+    /// §5.1.7, for small torsion components in the `R` value of the signature,
+    /// *which is not strictly required*, as they state:
+    ///
+    /// > Check the group equation \[8\]\[S\]B = \[8\]R + \[8\]\[k\]A'.  It's
+    /// > sufficient, but not required, to instead check \[S\]B = R + \[k\]A'.
+    ///
+    /// # History of Malleability Checks
+    ///
+    /// As originally defined (cf. the "Malleability" section in the README of
+    /// this repo), ed25519 signatures didn't consider *any* form of
+    /// malleability to be an issue.  Later the scalar malleability was
+    /// considered important.  Still later, particularly with interests in
+    /// cryptocurrency design and in unique identities (e.g. for Signal users,
+    /// Tor onion services, etc.), the group element malleability became a
+    /// concern.
+    ///
+    /// However, libraries had already been created to conform to the original
+    /// definition.  One well-used library in particular even implemented the
+    /// group element malleability check, *but only for batch verification*!
+    /// Which meant that even using the same library, a single signature could
+    /// verify fine individually, but suddenly, when verifying it with a bunch
+    /// of other signatures, the whole batch would fail!
+    ///
+    /// # "Strict" Verification
+    ///
+    /// This method performs *both* of the above signature malleability checks.
+    ///
+    /// It must be done as a separate method because one doesn't simply get to
+    /// change the definition of a cryptographic primitive ten years
+    /// after-the-fact with zero consideration for backwards compatibility in
+    /// hardware and protocols which have it already have the older definition
+    /// baked in.
+    ///
+    /// # Return
+    ///
+    /// Returns `Ok(())` if the signature is valid, and `Err` otherwise.
+    #[allow(non_snake_case)]
+    pub fn verify_strict(
+        &self,
+        message: &[u8],
+        signature: &Signature,
+    ) -> Result<(), SignatureError> {
+        self.verifying_key.verify_strict(message, signature)
+    }
+
+    /// Constructs stream verifier with candidate `signature`.
+    ///
+    /// See [`VerifyingKey::verify_stream()`] for more details.
+    #[cfg(feature = "hazmat")]
+    pub fn verify_stream(
+        &self,
+        signature: &ed25519::Signature,
+    ) -> Result<StreamVerifier, SignatureError> {
+        self.verifying_key.verify_stream(signature)
+    }
+
+    /// Convert this signing key into a byte representation of an unreduced, unclamped Curve25519
+    /// scalar. This is NOT the same thing as `self.to_scalar().to_bytes()`, since `to_scalar()`
+    /// performs a clamping step, which changes the value of the resulting scalar.
+    ///
+    /// This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The bytes output
+    /// by this function are a valid corresponding [`StaticSecret`](https://docs.rs/x25519-dalek/2.0.0/x25519_dalek/struct.StaticSecret.html#impl-From%3C%5Bu8;+32%5D%3E-for-StaticSecret)
+    /// for the X25519 public key given by `self.verifying_key().to_montgomery()`.
+    ///
+    /// # Note
+    ///
+    /// We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually
+    /// long-term keys, while keys used for key exchange should rather be ephemeral. If you can
+    /// help it, use a separate key for encryption.
+    ///
+    /// For more information on the security of systems which use the same keys for both signing
+    /// and Diffie-Hellman, see the paper
+    /// [On using the same key pair for Ed25519 and an X25519 based KEM](https://eprint.iacr.org/2021/509).
+    pub fn to_scalar_bytes(&self) -> [u8; 32] {
+        // Per the spec, the ed25519 secret key sk is expanded to
+        //     (scalar_bytes, hash_prefix) = SHA-512(sk)
+        // where the two outputs are both 32 bytes. scalar_bytes is what we return. Its clamped and
+        // reduced form is what we use for signing (see impl ExpandedSecretKey)
+        let mut buf = [0u8; 32];
+        let scalar_and_hash_prefix = Sha512::default().chain_update(self.secret_key).finalize();
+        buf.copy_from_slice(&scalar_and_hash_prefix[..32]);
+        buf
+    }
+
+    /// Convert this signing key into a Curve25519 scalar. This is computed by clamping and
+    /// reducing the output of [`Self::to_scalar_bytes`].
+    ///
+    /// This can be used anywhere where a Curve25519 scalar is used as a private key, e.g., in
+    /// [`crypto_box`](https://docs.rs/crypto_box/0.9.1/crypto_box/struct.SecretKey.html#impl-From%3CScalar%3E-for-SecretKey).
+    ///
+    /// # Note
+    ///
+    /// We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually
+    /// long-term keys, while keys used for key exchange should rather be ephemeral. If you can
+    /// help it, use a separate key for encryption.
+    ///
+    /// For more information on the security of systems which use the same keys for both signing
+    /// and Diffie-Hellman, see the paper
+    /// [On using the same key pair for Ed25519 and an X25519 based KEM](https://eprint.iacr.org/2021/509).
+    pub fn to_scalar(&self) -> Scalar {
+        // Per the spec, the ed25519 secret key sk is expanded to
+        //     (scalar_bytes, hash_prefix) = SHA-512(sk)
+        // where the two outputs are both 32 bytes. To use for signing, scalar_bytes must be
+        // clamped and reduced (see ExpandedSecretKey::from_bytes). We return the clamped and
+        // reduced form.
+        ExpandedSecretKey::from(&self.secret_key).scalar
+    }
+}
+
+impl AsRef<VerifyingKey> for SigningKey {
+    fn as_ref(&self) -> &VerifyingKey {
+        &self.verifying_key
+    }
+}
+
+impl Debug for SigningKey {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        f.debug_struct("SigningKey")
+            .field("verifying_key", &self.verifying_key)
+            .finish_non_exhaustive() // avoids printing `secret_key`
+    }
+}
+
+impl KeypairRef for SigningKey {
+    type VerifyingKey = VerifyingKey;
+}
+
+impl Signer<Signature> for SigningKey {
+    /// Sign a message with this signing key's secret key.
+    fn try_sign(&self, message: &[u8]) -> Result<Signature, SignatureError> {
+        let expanded: ExpandedSecretKey = (&self.secret_key).into();
+        Ok(expanded.raw_sign::<Sha512>(message, &self.verifying_key))
+    }
+}
+
+/// Equivalent to [`SigningKey::sign_prehashed`] with `context` set to [`None`].
+///
+/// # Note
+///
+/// The RFC only permits SHA-512 to be used for prehashing. This function technically works, and is
+/// probably safe to use, with any secure hash function with 512-bit digests, but anything outside
+/// of SHA-512 is NOT specification-compliant. We expose [`crate::Sha512`] for user convenience.
+#[cfg(feature = "digest")]
+impl<D> DigestSigner<D, Signature> for SigningKey
+where
+    D: Digest<OutputSize = U64>,
+{
+    fn try_sign_digest(&self, msg_digest: D) -> Result<Signature, SignatureError> {
+        self.sign_prehashed(msg_digest, None)
+    }
+}
+
+/// Equivalent to [`SigningKey::sign_prehashed`] with `context` set to [`Some`]
+/// containing `self.value()`.
+///
+/// # Note
+///
+/// The RFC only permits SHA-512 to be used for prehashing. This function technically works, and is
+/// probably safe to use, with any secure hash function with 512-bit digests, but anything outside
+/// of SHA-512 is NOT specification-compliant. We expose [`crate::Sha512`] for user convenience.
+#[cfg(feature = "digest")]
+impl<D> DigestSigner<D, Signature> for Context<'_, '_, SigningKey>
+where
+    D: Digest<OutputSize = U64>,
+{
+    fn try_sign_digest(&self, msg_digest: D) -> Result<Signature, SignatureError> {
+        self.key().sign_prehashed(msg_digest, Some(self.value()))
+    }
+}
+
+impl Verifier<Signature> for SigningKey {
+    /// Verify a signature on a message with this signing key's public key.
+    fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), SignatureError> {
+        self.verifying_key.verify(message, signature)
+    }
+}
+
+impl From<SecretKey> for SigningKey {
+    #[inline]
+    fn from(secret: SecretKey) -> Self {
+        Self::from_bytes(&secret)
+    }
+}
+
+impl From<&SecretKey> for SigningKey {
+    #[inline]
+    fn from(secret: &SecretKey) -> Self {
+        Self::from_bytes(secret)
+    }
+}
+
+impl TryFrom<&[u8]> for SigningKey {
+    type Error = SignatureError;
+
+    fn try_from(bytes: &[u8]) -> Result<SigningKey, SignatureError> {
+        SecretKey::try_from(bytes)
+            .map(|bytes| Self::from_bytes(&bytes))
+            .map_err(|_| {
+                InternalError::BytesLength {
+                    name: "SecretKey",
+                    length: SECRET_KEY_LENGTH,
+                }
+                .into()
+            })
+    }
+}
+
+impl ConstantTimeEq for SigningKey {
+    fn ct_eq(&self, other: &Self) -> Choice {
+        self.secret_key.ct_eq(&other.secret_key)
+    }
+}
+
+impl PartialEq for SigningKey {
+    fn eq(&self, other: &Self) -> bool {
+        self.ct_eq(other).into()
+    }
+}
+
+impl Eq for SigningKey {}
+
+#[cfg(feature = "zeroize")]
+impl Drop for SigningKey {
+    fn drop(&mut self) {
+        self.secret_key.zeroize();
+    }
+}
+
+#[cfg(feature = "zeroize")]
+impl ZeroizeOnDrop for SigningKey {}
+
+#[cfg(all(feature = "alloc", feature = "pkcs8"))]
+impl pkcs8::EncodePrivateKey for SigningKey {
+    fn to_pkcs8_der(&self) -> pkcs8::Result<pkcs8::SecretDocument> {
+        pkcs8::KeypairBytes::from(self).to_pkcs8_der()
+    }
+}
+
+#[cfg(all(feature = "alloc", feature = "pkcs8"))]
+impl pkcs8::spki::DynSignatureAlgorithmIdentifier for SigningKey {
+    fn signature_algorithm_identifier(
+        &self,
+    ) -> pkcs8::spki::Result<pkcs8::spki::AlgorithmIdentifierOwned> {
+        // From https://datatracker.ietf.org/doc/html/rfc8410
+        // `id-Ed25519   OBJECT IDENTIFIER ::= { 1 3 101 112 }`
+        Ok(pkcs8::spki::AlgorithmIdentifier {
+            oid: ed25519::pkcs8::ALGORITHM_OID,
+            parameters: None,
+        })
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl TryFrom<pkcs8::KeypairBytes> for SigningKey {
+    type Error = pkcs8::Error;
+
+    fn try_from(pkcs8_key: pkcs8::KeypairBytes) -> pkcs8::Result<Self> {
+        SigningKey::try_from(&pkcs8_key)
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl TryFrom<&pkcs8::KeypairBytes> for SigningKey {
+    type Error = pkcs8::Error;
+
+    fn try_from(pkcs8_key: &pkcs8::KeypairBytes) -> pkcs8::Result<Self> {
+        let signing_key = SigningKey::from_bytes(&pkcs8_key.secret_key);
+
+        // Validate the public key in the PKCS#8 document if present
+        if let Some(public_bytes) = &pkcs8_key.public_key {
+            let expected_verifying_key = VerifyingKey::from_bytes(public_bytes.as_ref())
+                .map_err(|_| pkcs8::Error::KeyMalformed)?;
+
+            if signing_key.verifying_key() != expected_verifying_key {
+                return Err(pkcs8::Error::KeyMalformed);
+            }
+        }
+
+        Ok(signing_key)
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl From<SigningKey> for pkcs8::KeypairBytes {
+    fn from(signing_key: SigningKey) -> pkcs8::KeypairBytes {
+        pkcs8::KeypairBytes::from(&signing_key)
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl From<&SigningKey> for pkcs8::KeypairBytes {
+    fn from(signing_key: &SigningKey) -> pkcs8::KeypairBytes {
+        pkcs8::KeypairBytes {
+            secret_key: signing_key.to_bytes(),
+            public_key: Some(pkcs8::PublicKeyBytes(signing_key.verifying_key.to_bytes())),
+        }
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl TryFrom<pkcs8::PrivateKeyInfo<'_>> for SigningKey {
+    type Error = pkcs8::Error;
+
+    fn try_from(private_key: pkcs8::PrivateKeyInfo<'_>) -> pkcs8::Result<Self> {
+        pkcs8::KeypairBytes::try_from(private_key)?.try_into()
+    }
+}
+
+#[cfg(feature = "serde")]
+impl Serialize for SigningKey {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_bytes(&self.secret_key)
+    }
+}
+
+#[cfg(feature = "serde")]
+impl<'d> Deserialize<'d> for SigningKey {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'d>,
+    {
+        struct SigningKeyVisitor;
+
+        impl<'de> serde::de::Visitor<'de> for SigningKeyVisitor {
+            type Value = SigningKey;
+
+            fn expecting(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+                write!(formatter, concat!("An ed25519 signing (private) key"))
+            }
+
+            fn visit_bytes<E: serde::de::Error>(self, bytes: &[u8]) -> Result<Self::Value, E> {
+                SigningKey::try_from(bytes).map_err(E::custom)
+            }
+
+            fn visit_seq<A>(self, mut seq: A) -> Result<Self::Value, A::Error>
+            where
+                A: serde::de::SeqAccess<'de>,
+            {
+                let mut bytes = [0u8; 32];
+                #[allow(clippy::needless_range_loop)]
+                for i in 0..32 {
+                    bytes[i] = seq
+                        .next_element()?
+                        .ok_or_else(|| serde::de::Error::invalid_length(i, &"expected 32 bytes"))?;
+                }
+
+                let remaining = (0..)
+                    .map(|_| seq.next_element::<u8>())
+                    .take_while(|el| matches!(el, Ok(Some(_))))
+                    .count();
+
+                if remaining > 0 {
+                    return Err(serde::de::Error::invalid_length(
+                        32 + remaining,
+                        &"expected 32 bytes",
+                    ));
+                }
+
+                Ok(SigningKey::from(bytes))
+            }
+        }
+
+        deserializer.deserialize_bytes(SigningKeyVisitor)
+    }
+}
+
+/// The spec-compliant way to define an expanded secret key. This computes `SHA512(sk)`, clamps the
+/// first 32 bytes and uses it as a scalar, and uses the second 32 bytes as a domain separator for
+/// hashing.
+impl From<&SecretKey> for ExpandedSecretKey {
+    #[allow(clippy::unwrap_used)]
+    fn from(secret_key: &SecretKey) -> ExpandedSecretKey {
+        let hash = Sha512::default().chain_update(secret_key).finalize();
+        ExpandedSecretKey::from_bytes(hash.as_ref())
+    }
+}
+
+//
+// Signing functions. These are pub(crate) so that the `hazmat` module can use them
+//
+
+impl ExpandedSecretKey {
+    /// The plain, non-prehashed, signing function for Ed25519. `CtxDigest` is the digest used to
+    /// calculate the pseudorandomness needed for signing. According to the spec, `CtxDigest =
+    /// Sha512`, and `self` is derived via the method defined in `impl From<&SigningKey> for
+    /// ExpandedSecretKey`.
+    ///
+    /// This definition is loose in its parameters so that end-users of the `hazmat` module can
+    /// change how the `ExpandedSecretKey` is calculated and which hash function to use.
+    #[allow(non_snake_case)]
+    #[allow(clippy::unwrap_used)]
+    #[inline(always)]
+    pub(crate) fn raw_sign<CtxDigest>(
+        &self,
+        message: &[u8],
+        verifying_key: &VerifyingKey,
+    ) -> Signature
+    where
+        CtxDigest: Digest<OutputSize = U64>,
+    {
+        // OK unwrap, update can't fail.
+        self.raw_sign_byupdate(
+            |h: &mut CtxDigest| {
+                h.update(message);
+                Ok(())
+            },
+            verifying_key,
+        )
+        .unwrap()
+    }
+
+    /// Sign a message provided in parts. The `msg_update` closure will be called twice to hash the
+    /// message parts. This closure MUST leave its hasher in the same state (i.e., must hash the
+    /// same values) after both calls. Otherwise it will produce an invalid signature.
+    #[allow(non_snake_case)]
+    #[inline(always)]
+    pub(crate) fn raw_sign_byupdate<CtxDigest, F>(
+        &self,
+        msg_update: F,
+        verifying_key: &VerifyingKey,
+    ) -> Result<Signature, SignatureError>
+    where
+        CtxDigest: Digest<OutputSize = U64>,
+        F: Fn(&mut CtxDigest) -> Result<(), SignatureError>,
+    {
+        let mut h = CtxDigest::new();
+
+        h.update(self.hash_prefix);
+        msg_update(&mut h)?;
+
+        let r = Scalar::from_hash(h);
+        let R: CompressedEdwardsY = EdwardsPoint::mul_base(&r).compress();
+
+        h = CtxDigest::new();
+        h.update(R.as_bytes());
+        h.update(verifying_key.as_bytes());
+        msg_update(&mut h)?;
+
+        let k = Scalar::from_hash(h);
+        let s: Scalar = (k * self.scalar) + r;
+
+        Ok(InternalSignature { R, s }.into())
+    }
+
+    /// The prehashed signing function for Ed25519 (i.e., Ed25519ph). `CtxDigest` is the digest
+    /// function used to calculate the pseudorandomness needed for signing. `MsgDigest` is the
+    /// digest function used to hash the signed message. According to the spec, `MsgDigest =
+    /// CtxDigest = Sha512`, and `self` is derived via the method defined in `impl
+    /// From<&SigningKey> for ExpandedSecretKey`.
+    ///
+    /// This definition is loose in its parameters so that end-users of the `hazmat` module can
+    /// change how the `ExpandedSecretKey` is calculated and which `CtxDigest` function to use.
+    #[cfg(feature = "digest")]
+    #[allow(non_snake_case)]
+    #[inline(always)]
+    pub(crate) fn raw_sign_prehashed<CtxDigest, MsgDigest>(
+        &self,
+        prehashed_message: MsgDigest,
+        verifying_key: &VerifyingKey,
+        context: Option<&[u8]>,
+    ) -> Result<Signature, SignatureError>
+    where
+        CtxDigest: Digest<OutputSize = U64>,
+        MsgDigest: Digest<OutputSize = U64>,
+    {
+        let mut prehash: [u8; 64] = [0u8; 64];
+
+        let ctx: &[u8] = context.unwrap_or(b""); // By default, the context is an empty string.
+
+        if ctx.len() > 255 {
+            return Err(SignatureError::from(InternalError::PrehashedContextLength));
+        }
+
+        let ctx_len: u8 = ctx.len() as u8;
+
+        // Get the result of the pre-hashed message.
+        prehash.copy_from_slice(prehashed_message.finalize().as_slice());
+
+        // This is the dumbest, ten-years-late, non-admission of fucking up the
+        // domain separation I have ever seen.  Why am I still required to put
+        // the upper half "prefix" of the hashed "secret key" in here?  Why
+        // can't the user just supply their own nonce and decide for themselves
+        // whether or not they want a deterministic signature scheme?  Why does
+        // the message go into what's ostensibly the signature domain separation
+        // hash?  Why wasn't there always a way to provide a context string?
+        //
+        // ...
+        //
+        // This is a really fucking stupid bandaid, and the damned scheme is
+        // still bleeding from malleability, for fuck's sake.
+        let mut h = CtxDigest::new()
+            .chain_update(b"SigEd25519 no Ed25519 collisions")
+            .chain_update([1]) // Ed25519ph
+            .chain_update([ctx_len])
+            .chain_update(ctx)
+            .chain_update(self.hash_prefix)
+            .chain_update(&prehash[..]);
+
+        let r = Scalar::from_hash(h);
+        let R: CompressedEdwardsY = EdwardsPoint::mul_base(&r).compress();
+
+        h = CtxDigest::new()
+            .chain_update(b"SigEd25519 no Ed25519 collisions")
+            .chain_update([1]) // Ed25519ph
+            .chain_update([ctx_len])
+            .chain_update(ctx)
+            .chain_update(R.as_bytes())
+            .chain_update(verifying_key.as_bytes())
+            .chain_update(&prehash[..]);
+
+        let k = Scalar::from_hash(h);
+        let s: Scalar = (k * self.scalar) + r;
+
+        Ok(InternalSignature { R, s }.into())
+    }
+}

vendor/ed25519-dalek/src/verifying.rs

@@ -0,0 +1,741 @@
+// -*- mode: rust; -*-
+//
+// This file is part of ed25519-dalek.
+// Copyright (c) 2017-2019 isis lovecruft
+// See LICENSE for licensing information.
+//
+// Authors:
+// - isis agora lovecruft <isis@patternsinthevoid.net>
+
+//! ed25519 public keys.
+
+use core::fmt::Debug;
+use core::hash::{Hash, Hasher};
+
+use curve25519_dalek::{
+    digest::{generic_array::typenum::U64, Digest},
+    edwards::{CompressedEdwardsY, EdwardsPoint},
+    montgomery::MontgomeryPoint,
+    scalar::Scalar,
+};
+
+use ed25519::signature::Verifier;
+
+use sha2::Sha512;
+
+#[cfg(feature = "pkcs8")]
+use ed25519::pkcs8;
+
+#[cfg(feature = "serde")]
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+#[cfg(feature = "digest")]
+use crate::context::Context;
+#[cfg(feature = "digest")]
+use signature::DigestVerifier;
+
+use crate::{
+    constants::PUBLIC_KEY_LENGTH,
+    errors::{InternalError, SignatureError},
+    hazmat::ExpandedSecretKey,
+    signature::InternalSignature,
+    signing::SigningKey,
+};
+
+#[cfg(feature = "hazmat")]
+mod stream;
+#[cfg(feature = "hazmat")]
+pub use self::stream::StreamVerifier;
+
+/// An ed25519 public key.
+///
+/// # Note
+///
+/// The `Eq` and `Hash` impls here use the compressed Edwards y encoding, _not_ the algebraic
+/// representation. This means if this `VerifyingKey` is non-canonically encoded, it will be
+/// considered unequal to the other equivalent encoding, despite the two representing the same
+/// point. More encoding details can be found
+/// [here](https://hdevalence.ca/blog/2020-10-04-its-25519am).
+/// If you want to make sure that signatures produced with respect to those sorts of public keys
+/// are rejected, use [`VerifyingKey::verify_strict`].
+// Invariant: VerifyingKey.1 is always the decompression of VerifyingKey.0
+#[derive(Copy, Clone, Default, Eq)]
+pub struct VerifyingKey {
+    /// Serialized compressed Edwards-y point.
+    pub(crate) compressed: CompressedEdwardsY,
+
+    /// Decompressed Edwards point used for curve arithmetic operations.
+    pub(crate) point: EdwardsPoint,
+}
+
+impl Debug for VerifyingKey {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(f, "VerifyingKey({:?}), {:?})", self.compressed, self.point)
+    }
+}
+
+impl AsRef<[u8]> for VerifyingKey {
+    fn as_ref(&self) -> &[u8] {
+        self.as_bytes()
+    }
+}
+
+impl Hash for VerifyingKey {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.as_bytes().hash(state);
+    }
+}
+
+impl PartialEq<VerifyingKey> for VerifyingKey {
+    fn eq(&self, other: &VerifyingKey) -> bool {
+        self.as_bytes() == other.as_bytes()
+    }
+}
+
+impl From<&ExpandedSecretKey> for VerifyingKey {
+    /// Derive this public key from its corresponding `ExpandedSecretKey`.
+    fn from(expanded_secret_key: &ExpandedSecretKey) -> VerifyingKey {
+        VerifyingKey::from(EdwardsPoint::mul_base(&expanded_secret_key.scalar))
+    }
+}
+
+impl From<&SigningKey> for VerifyingKey {
+    fn from(signing_key: &SigningKey) -> VerifyingKey {
+        signing_key.verifying_key()
+    }
+}
+
+impl From<EdwardsPoint> for VerifyingKey {
+    fn from(point: EdwardsPoint) -> VerifyingKey {
+        VerifyingKey {
+            point,
+            compressed: point.compress(),
+        }
+    }
+}
+
+impl VerifyingKey {
+    /// Convert this public key to a byte array.
+    #[inline]
+    pub fn to_bytes(&self) -> [u8; PUBLIC_KEY_LENGTH] {
+        self.compressed.to_bytes()
+    }
+
+    /// View this public key as a byte array.
+    #[inline]
+    pub fn as_bytes(&self) -> &[u8; PUBLIC_KEY_LENGTH] {
+        &(self.compressed).0
+    }
+
+    /// Construct a `VerifyingKey` from a slice of bytes.
+    ///
+    /// Verifies the point is valid under [ZIP-215] rules. RFC 8032 / NIST point validation criteria
+    /// are currently unsupported (see [dalek-cryptography/curve25519-dalek#626]).
+    ///
+    /// # Example
+    ///
+    /// ```
+    /// use ed25519_dalek::VerifyingKey;
+    /// use ed25519_dalek::PUBLIC_KEY_LENGTH;
+    /// use ed25519_dalek::SignatureError;
+    ///
+    /// # fn doctest() -> Result<VerifyingKey, SignatureError> {
+    /// let public_key_bytes: [u8; PUBLIC_KEY_LENGTH] = [
+    ///    215,  90, 152,   1, 130, 177,  10, 183, 213,  75, 254, 211, 201, 100,   7,  58,
+    ///     14, 225, 114, 243, 218, 166,  35,  37, 175,   2,  26, 104, 247,   7,   81, 26];
+    ///
+    /// let public_key = VerifyingKey::from_bytes(&public_key_bytes)?;
+    /// #
+    /// # Ok(public_key)
+    /// # }
+    /// #
+    /// # fn main() {
+    /// #     doctest();
+    /// # }
+    /// ```
+    ///
+    /// # Returns
+    ///
+    /// A `Result` whose okay value is an EdDSA `VerifyingKey` or whose error value
+    /// is a `SignatureError` describing the error that occurred.
+    ///
+    /// [ZIP-215]: https://zips.z.cash/zip-0215
+    /// [dalek-cryptography/curve25519-dalek#626]: https://github.com/dalek-cryptography/curve25519-dalek/issues/626
+    #[inline]
+    pub fn from_bytes(bytes: &[u8; PUBLIC_KEY_LENGTH]) -> Result<VerifyingKey, SignatureError> {
+        let compressed = CompressedEdwardsY(*bytes);
+        let point = compressed
+            .decompress()
+            .ok_or(InternalError::PointDecompression)?;
+
+        // Invariant: VerifyingKey.1 is always the decompression of VerifyingKey.0
+        Ok(VerifyingKey { compressed, point })
+    }
+
+    /// Create a verifying context that can be used for Ed25519ph with
+    /// [`DigestVerifier`].
+    #[cfg(feature = "digest")]
+    pub fn with_context<'k, 'v>(
+        &'k self,
+        context_value: &'v [u8],
+    ) -> Result<Context<'k, 'v, Self>, SignatureError> {
+        Context::new(self, context_value)
+    }
+
+    /// Returns whether this is a _weak_ public key, i.e., if this public key has low order.
+    ///
+    /// A weak public key can be used to generate a signature that's valid for almost every
+    /// message. [`Self::verify_strict`] denies weak keys, but if you want to check for this
+    /// property before verification, then use this method.
+    pub fn is_weak(&self) -> bool {
+        self.point.is_small_order()
+    }
+
+    /// The ordinary non-batched Ed25519 verification check, rejecting non-canonical R values. (see
+    /// [`Self::RCompute`]). `CtxDigest` is the digest used to calculate the pseudorandomness
+    /// needed for signing. According to the spec, `CtxDigest = Sha512`.
+    ///
+    /// This definition is loose in its parameters so that end-users of the `hazmat` module can
+    /// change how the `ExpandedSecretKey` is calculated and which hash function to use.
+    #[allow(non_snake_case)]
+    pub(crate) fn raw_verify<CtxDigest>(
+        &self,
+        message: &[u8],
+        signature: &ed25519::Signature,
+    ) -> Result<(), SignatureError>
+    where
+        CtxDigest: Digest<OutputSize = U64>,
+    {
+        let signature = InternalSignature::try_from(signature)?;
+
+        let expected_R = RCompute::<CtxDigest>::compute(self, signature, None, message);
+        if expected_R == signature.R {
+            Ok(())
+        } else {
+            Err(InternalError::Verify.into())
+        }
+    }
+
+    /// The prehashed non-batched Ed25519 verification check, rejecting non-canonical R values.
+    /// (see [`Self::recompute_R`]). `CtxDigest` is the digest used to calculate the
+    /// pseudorandomness needed for signing. `MsgDigest` is the digest used to hash the signed
+    /// message. According to the spec, `MsgDigest = CtxDigest = Sha512`.
+    ///
+    /// This definition is loose in its parameters so that end-users of the `hazmat` module can
+    /// change how the `ExpandedSecretKey` is calculated and which hash function to use.
+    #[cfg(feature = "digest")]
+    #[allow(non_snake_case)]
+    pub(crate) fn raw_verify_prehashed<CtxDigest, MsgDigest>(
+        &self,
+        prehashed_message: MsgDigest,
+        context: Option<&[u8]>,
+        signature: &ed25519::Signature,
+    ) -> Result<(), SignatureError>
+    where
+        CtxDigest: Digest<OutputSize = U64>,
+        MsgDigest: Digest<OutputSize = U64>,
+    {
+        let signature = InternalSignature::try_from(signature)?;
+
+        let ctx: &[u8] = context.unwrap_or(b"");
+        debug_assert!(
+            ctx.len() <= 255,
+            "The context must not be longer than 255 octets."
+        );
+
+        let message = prehashed_message.finalize();
+
+        let expected_R = RCompute::<CtxDigest>::compute(self, signature, Some(ctx), &message);
+
+        if expected_R == signature.R {
+            Ok(())
+        } else {
+            Err(InternalError::Verify.into())
+        }
+    }
+
+    /// Verify a `signature` on a `prehashed_message` using the Ed25519ph algorithm.
+    ///
+    /// # Inputs
+    ///
+    /// * `prehashed_message` is an instantiated hash digest with 512-bits of
+    ///   output which has had the message to be signed previously fed into its
+    ///   state.
+    /// * `context` is an optional context string, up to 255 bytes inclusive,
+    ///   which may be used to provide additional domain separation.  If not
+    ///   set, this will default to an empty string.
+    /// * `signature` is a purported Ed25519ph signature on the `prehashed_message`.
+    ///
+    /// # Returns
+    ///
+    /// Returns `true` if the `signature` was a valid signature created by this
+    /// [`SigningKey`] on the `prehashed_message`.
+    ///
+    /// # Note
+    ///
+    /// The RFC only permits SHA-512 to be used for prehashing, i.e., `MsgDigest = Sha512`. This
+    /// function technically works, and is probably safe to use, with any secure hash function with
+    /// 512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose
+    /// [`crate::Sha512`] for user convenience.
+    #[cfg(feature = "digest")]
+    #[allow(non_snake_case)]
+    pub fn verify_prehashed<MsgDigest>(
+        &self,
+        prehashed_message: MsgDigest,
+        context: Option<&[u8]>,
+        signature: &ed25519::Signature,
+    ) -> Result<(), SignatureError>
+    where
+        MsgDigest: Digest<OutputSize = U64>,
+    {
+        self.raw_verify_prehashed::<Sha512, MsgDigest>(prehashed_message, context, signature)
+    }
+
+    /// Strictly verify a signature on a message with this keypair's public key.
+    ///
+    /// # On The (Multiple) Sources of Malleability in Ed25519 Signatures
+    ///
+    /// This version of verification is technically non-RFC8032 compliant.  The
+    /// following explains why.
+    ///
+    /// 1. Scalar Malleability
+    ///
+    /// The authors of the RFC explicitly stated that verification of an ed25519
+    /// signature must fail if the scalar `s` is not properly reduced mod $\ell$:
+    ///
+    /// > To verify a signature on a message M using public key A, with F
+    /// > being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or
+    /// > Ed25519ph is being used, C being the context, first split the
+    /// > signature into two 32-octet halves.  Decode the first half as a
+    /// > point R, and the second half as an integer S, in the range
+    /// > 0 <= s < L.  Decode the public key A as point A'.  If any of the
+    /// > decodings fail (including S being out of range), the signature is
+    /// > invalid.)
+    ///
+    /// All `verify_*()` functions within ed25519-dalek perform this check.
+    ///
+    /// 2. Point malleability
+    ///
+    /// The authors of the RFC added in a malleability check to step #3 in
+    /// §5.1.7, for small torsion components in the `R` value of the signature,
+    /// *which is not strictly required*, as they state:
+    ///
+    /// > Check the group equation \[8\]\[S\]B = \[8\]R + \[8\]\[k\]A'.  It's
+    /// > sufficient, but not required, to instead check \[S\]B = R + \[k\]A'.
+    ///
+    /// # History of Malleability Checks
+    ///
+    /// As originally defined (cf. the "Malleability" section in the README of
+    /// this repo), ed25519 signatures didn't consider *any* form of
+    /// malleability to be an issue.  Later the scalar malleability was
+    /// considered important.  Still later, particularly with interests in
+    /// cryptocurrency design and in unique identities (e.g. for Signal users,
+    /// Tor onion services, etc.), the group element malleability became a
+    /// concern.
+    ///
+    /// However, libraries had already been created to conform to the original
+    /// definition.  One well-used library in particular even implemented the
+    /// group element malleability check, *but only for batch verification*!
+    /// Which meant that even using the same library, a single signature could
+    /// verify fine individually, but suddenly, when verifying it with a bunch
+    /// of other signatures, the whole batch would fail!
+    ///
+    /// # "Strict" Verification
+    ///
+    /// This method performs *both* of the above signature malleability checks.
+    ///
+    /// It must be done as a separate method because one doesn't simply get to
+    /// change the definition of a cryptographic primitive ten years
+    /// after-the-fact with zero consideration for backwards compatibility in
+    /// hardware and protocols which have it already have the older definition
+    /// baked in.
+    ///
+    /// # Return
+    ///
+    /// Returns `Ok(())` if the signature is valid, and `Err` otherwise.
+    #[allow(non_snake_case)]
+    pub fn verify_strict(
+        &self,
+        message: &[u8],
+        signature: &ed25519::Signature,
+    ) -> Result<(), SignatureError> {
+        let signature = InternalSignature::try_from(signature)?;
+
+        let signature_R = signature
+            .R
+            .decompress()
+            .ok_or_else(|| SignatureError::from(InternalError::Verify))?;
+
+        // Logical OR is fine here as we're not trying to be constant time.
+        if signature_R.is_small_order() || self.point.is_small_order() {
+            return Err(InternalError::Verify.into());
+        }
+
+        let expected_R = RCompute::<Sha512>::compute(self, signature, None, message);
+        if expected_R == signature.R {
+            Ok(())
+        } else {
+            Err(InternalError::Verify.into())
+        }
+    }
+
+    /// Constructs stream verifier with candidate `signature`.
+    ///
+    /// Useful for cases where the whole message is not available all at once, allowing the
+    /// internal signature state to be updated incrementally and verified at the end. In some cases,
+    /// this will reduce the need for additional allocations.
+    #[cfg(feature = "hazmat")]
+    pub fn verify_stream(
+        &self,
+        signature: &ed25519::Signature,
+    ) -> Result<StreamVerifier, SignatureError> {
+        let signature = InternalSignature::try_from(signature)?;
+        Ok(StreamVerifier::new(*self, signature))
+    }
+
+    /// Verify a `signature` on a `prehashed_message` using the Ed25519ph algorithm,
+    /// using strict signature checking as defined by [`Self::verify_strict`].
+    ///
+    /// # Inputs
+    ///
+    /// * `prehashed_message` is an instantiated hash digest with 512-bits of
+    ///   output which has had the message to be signed previously fed into its
+    ///   state.
+    /// * `context` is an optional context string, up to 255 bytes inclusive,
+    ///   which may be used to provide additional domain separation.  If not
+    ///   set, this will default to an empty string.
+    /// * `signature` is a purported Ed25519ph signature on the `prehashed_message`.
+    ///
+    /// # Returns
+    ///
+    /// Returns `true` if the `signature` was a valid signature created by this
+    /// [`SigningKey`] on the `prehashed_message`.
+    ///
+    /// # Note
+    ///
+    /// The RFC only permits SHA-512 to be used for prehashing, i.e., `MsgDigest = Sha512`. This
+    /// function technically works, and is probably safe to use, with any secure hash function with
+    /// 512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose
+    /// [`crate::Sha512`] for user convenience.
+    #[cfg(feature = "digest")]
+    #[allow(non_snake_case)]
+    pub fn verify_prehashed_strict<MsgDigest>(
+        &self,
+        prehashed_message: MsgDigest,
+        context: Option<&[u8]>,
+        signature: &ed25519::Signature,
+    ) -> Result<(), SignatureError>
+    where
+        MsgDigest: Digest<OutputSize = U64>,
+    {
+        let signature = InternalSignature::try_from(signature)?;
+
+        let ctx: &[u8] = context.unwrap_or(b"");
+        debug_assert!(
+            ctx.len() <= 255,
+            "The context must not be longer than 255 octets."
+        );
+
+        let signature_R = signature
+            .R
+            .decompress()
+            .ok_or_else(|| SignatureError::from(InternalError::Verify))?;
+
+        // Logical OR is fine here as we're not trying to be constant time.
+        if signature_R.is_small_order() || self.point.is_small_order() {
+            return Err(InternalError::Verify.into());
+        }
+
+        let message = prehashed_message.finalize();
+        let expected_R = RCompute::<Sha512>::compute(self, signature, Some(ctx), &message);
+
+        if expected_R == signature.R {
+            Ok(())
+        } else {
+            Err(InternalError::Verify.into())
+        }
+    }
+
+    /// Convert this verifying key into Montgomery form.
+    ///
+    /// This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The output of
+    /// this function is a valid X25519 public key whose secret key is `sk.to_scalar_bytes()`,
+    /// where `sk` is a valid signing key for this `VerifyingKey`.
+    ///
+    /// # Note
+    ///
+    /// We do NOT recommend this usage of a signing/verifying key. Signing keys are usually
+    /// long-term keys, while keys used for key exchange should rather be ephemeral. If you can
+    /// help it, use a separate key for encryption.
+    ///
+    /// For more information on the security of systems which use the same keys for both signing
+    /// and Diffie-Hellman, see the paper
+    /// [On using the same key pair for Ed25519 and an X25519 based KEM](https://eprint.iacr.org/2021/509).
+    pub fn to_montgomery(&self) -> MontgomeryPoint {
+        self.point.to_montgomery()
+    }
+
+    /// Return this verifying key in Edwards form.
+    pub fn to_edwards(&self) -> EdwardsPoint {
+        self.point
+    }
+}
+
+/// Helper for verification. Computes the _expected_ R component of the signature. The
+/// caller compares this to the real R component.
+/// This computes `H(R || A || M)` where `H` is the 512-bit hash function
+/// given by `CtxDigest` (this is SHA-512 in spec-compliant Ed25519).
+///
+/// For pre-hashed variants a `h` with the context already included can be provided.
+/// Note that this returns the compressed form of R and the caller does a byte comparison. This
+/// means that all our verification functions do not accept non-canonically encoded R values.
+/// See the validation criteria blog post for more details:
+///     https://hdevalence.ca/blog/2020-10-04-its-25519am
+pub(crate) struct RCompute<CtxDigest> {
+    key: VerifyingKey,
+    signature: InternalSignature,
+    h: CtxDigest,
+}
+
+#[allow(non_snake_case)]
+impl<CtxDigest> RCompute<CtxDigest>
+where
+    CtxDigest: Digest<OutputSize = U64>,
+{
+    /// If `prehash_ctx.is_some()`, this does the prehashed variant of the computation using its
+    /// contents.
+    pub(crate) fn compute(
+        key: &VerifyingKey,
+        signature: InternalSignature,
+        prehash_ctx: Option<&[u8]>,
+        message: &[u8],
+    ) -> CompressedEdwardsY {
+        let mut c = Self::new(key, signature, prehash_ctx);
+        c.update(message);
+        c.finish()
+    }
+
+    pub(crate) fn new(
+        key: &VerifyingKey,
+        signature: InternalSignature,
+        prehash_ctx: Option<&[u8]>,
+    ) -> Self {
+        let R = &signature.R;
+        let A = &key.compressed;
+
+        let mut h = CtxDigest::new();
+        if let Some(c) = prehash_ctx {
+            h.update(b"SigEd25519 no Ed25519 collisions");
+            h.update([1]); // Ed25519ph
+            h.update([c.len() as u8]);
+            h.update(c);
+        }
+
+        h.update(R.as_bytes());
+        h.update(A.as_bytes());
+        Self {
+            key: *key,
+            signature,
+            h,
+        }
+    }
+
+    pub(crate) fn update(&mut self, m: &[u8]) {
+        self.h.update(m)
+    }
+
+    pub(crate) fn finish(self) -> CompressedEdwardsY {
+        let k = Scalar::from_hash(self.h);
+
+        let minus_A: EdwardsPoint = -self.key.point;
+        // Recall the (non-batched) verification equation: -[k]A + [s]B = R
+        EdwardsPoint::vartime_double_scalar_mul_basepoint(&k, &(minus_A), &self.signature.s)
+            .compress()
+    }
+}
+
+impl Verifier<ed25519::Signature> for VerifyingKey {
+    /// Verify a signature on a message with this keypair's public key.
+    ///
+    /// # Return
+    ///
+    /// Returns `Ok(())` if the signature is valid, and `Err` otherwise.
+    fn verify(&self, message: &[u8], signature: &ed25519::Signature) -> Result<(), SignatureError> {
+        self.raw_verify::<Sha512>(message, signature)
+    }
+}
+
+/// Equivalent to [`VerifyingKey::verify_prehashed`] with `context` set to [`None`].
+#[cfg(feature = "digest")]
+impl<MsgDigest> DigestVerifier<MsgDigest, ed25519::Signature> for VerifyingKey
+where
+    MsgDigest: Digest<OutputSize = U64>,
+{
+    fn verify_digest(
+        &self,
+        msg_digest: MsgDigest,
+        signature: &ed25519::Signature,
+    ) -> Result<(), SignatureError> {
+        self.verify_prehashed(msg_digest, None, signature)
+    }
+}
+
+/// Equivalent to [`VerifyingKey::verify_prehashed`] with `context` set to [`Some`]
+/// containing `self.value()`.
+#[cfg(feature = "digest")]
+impl<MsgDigest> DigestVerifier<MsgDigest, ed25519::Signature> for Context<'_, '_, VerifyingKey>
+where
+    MsgDigest: Digest<OutputSize = U64>,
+{
+    fn verify_digest(
+        &self,
+        msg_digest: MsgDigest,
+        signature: &ed25519::Signature,
+    ) -> Result<(), SignatureError> {
+        self.key()
+            .verify_prehashed(msg_digest, Some(self.value()), signature)
+    }
+}
+
+impl TryFrom<&[u8]> for VerifyingKey {
+    type Error = SignatureError;
+
+    #[inline]
+    fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
+        let bytes = bytes.try_into().map_err(|_| InternalError::BytesLength {
+            name: "VerifyingKey",
+            length: PUBLIC_KEY_LENGTH,
+        })?;
+        Self::from_bytes(bytes)
+    }
+}
+
+impl From<VerifyingKey> for EdwardsPoint {
+    fn from(vk: VerifyingKey) -> EdwardsPoint {
+        vk.point
+    }
+}
+
+#[cfg(all(feature = "alloc", feature = "pkcs8"))]
+impl pkcs8::EncodePublicKey for VerifyingKey {
+    fn to_public_key_der(&self) -> pkcs8::spki::Result<pkcs8::Document> {
+        pkcs8::PublicKeyBytes::from(self).to_public_key_der()
+    }
+}
+
+#[cfg(all(feature = "alloc", feature = "pkcs8"))]
+impl pkcs8::spki::DynSignatureAlgorithmIdentifier for VerifyingKey {
+    fn signature_algorithm_identifier(
+        &self,
+    ) -> pkcs8::spki::Result<pkcs8::spki::AlgorithmIdentifierOwned> {
+        // From https://datatracker.ietf.org/doc/html/rfc8410
+        // `id-Ed25519   OBJECT IDENTIFIER ::= { 1 3 101 112 }`
+        Ok(ed25519::pkcs8::spki::AlgorithmIdentifierOwned {
+            oid: ed25519::pkcs8::ALGORITHM_OID,
+            parameters: None,
+        })
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl TryFrom<pkcs8::PublicKeyBytes> for VerifyingKey {
+    type Error = pkcs8::spki::Error;
+
+    fn try_from(pkcs8_key: pkcs8::PublicKeyBytes) -> pkcs8::spki::Result<Self> {
+        VerifyingKey::try_from(&pkcs8_key)
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl TryFrom<&pkcs8::PublicKeyBytes> for VerifyingKey {
+    type Error = pkcs8::spki::Error;
+
+    fn try_from(pkcs8_key: &pkcs8::PublicKeyBytes) -> pkcs8::spki::Result<Self> {
+        VerifyingKey::from_bytes(pkcs8_key.as_ref()).map_err(|_| pkcs8::spki::Error::KeyMalformed)
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl From<VerifyingKey> for pkcs8::PublicKeyBytes {
+    fn from(verifying_key: VerifyingKey) -> pkcs8::PublicKeyBytes {
+        pkcs8::PublicKeyBytes::from(&verifying_key)
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl From<&VerifyingKey> for pkcs8::PublicKeyBytes {
+    fn from(verifying_key: &VerifyingKey) -> pkcs8::PublicKeyBytes {
+        pkcs8::PublicKeyBytes(verifying_key.to_bytes())
+    }
+}
+
+#[cfg(feature = "pkcs8")]
+impl TryFrom<pkcs8::spki::SubjectPublicKeyInfoRef<'_>> for VerifyingKey {
+    type Error = pkcs8::spki::Error;
+
+    fn try_from(public_key: pkcs8::spki::SubjectPublicKeyInfoRef<'_>) -> pkcs8::spki::Result<Self> {
+        pkcs8::PublicKeyBytes::try_from(public_key)?.try_into()
+    }
+}
+
+#[cfg(feature = "serde")]
+impl Serialize for VerifyingKey {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_bytes(&self.as_bytes()[..])
+    }
+}
+
+#[cfg(feature = "serde")]
+impl<'d> Deserialize<'d> for VerifyingKey {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'d>,
+    {
+        struct VerifyingKeyVisitor;
+
+        impl<'de> serde::de::Visitor<'de> for VerifyingKeyVisitor {
+            type Value = VerifyingKey;
+
+            fn expecting(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+                write!(formatter, concat!("An ed25519 verifying (public) key"))
+            }
+
+            fn visit_bytes<E: serde::de::Error>(self, bytes: &[u8]) -> Result<Self::Value, E> {
+                VerifyingKey::try_from(bytes).map_err(E::custom)
+            }
+
+            fn visit_seq<A>(self, mut seq: A) -> Result<Self::Value, A::Error>
+            where
+                A: serde::de::SeqAccess<'de>,
+            {
+                let mut bytes = [0u8; 32];
+
+                #[allow(clippy::needless_range_loop)]
+                for i in 0..32 {
+                    bytes[i] = seq
+                        .next_element()?
+                        .ok_or_else(|| serde::de::Error::invalid_length(i, &"expected 32 bytes"))?;
+                }
+
+                let remaining = (0..)
+                    .map(|_| seq.next_element::<u8>())
+                    .take_while(|el| matches!(el, Ok(Some(_))))
+                    .count();
+
+                if remaining > 0 {
+                    return Err(serde::de::Error::invalid_length(
+                        32 + remaining,
+                        &"expected 32 bytes",
+                    ));
+                }
+
+                VerifyingKey::try_from(&bytes[..]).map_err(serde::de::Error::custom)
+            }
+        }
+
+        deserializer.deserialize_bytes(VerifyingKeyVisitor)
+    }
+}

vendor/ed25519-dalek/src/verifying/stream.rs

@@ -0,0 +1,45 @@
+use curve25519_dalek::edwards::CompressedEdwardsY;
+use sha2::Sha512;
+
+use crate::verifying::RCompute;
+use crate::{signature::InternalSignature, InternalError, SignatureError, VerifyingKey};
+
+/// An IUF verifier for ed25519.
+///
+/// Created with [`VerifyingKey::verify_stream()`] or [`SigningKey::verify_stream()`].
+///
+/// [`SigningKey::verify_stream()`]: super::SigningKey::verify_stream()
+#[allow(non_snake_case)]
+pub struct StreamVerifier {
+    cr: RCompute<Sha512>,
+    sig_R: CompressedEdwardsY,
+}
+
+impl StreamVerifier {
+    /// Constructs new stream verifier.
+    ///
+    /// Seeds hash state with public key and signature components.
+    pub(crate) fn new(public_key: VerifyingKey, signature: InternalSignature) -> Self {
+        Self {
+            cr: RCompute::new(&public_key, signature, None),
+            sig_R: signature.R,
+        }
+    }
+
+    /// Digest message chunk.
+    pub fn update(&mut self, chunk: impl AsRef<[u8]>) {
+        self.cr.update(chunk.as_ref());
+    }
+
+    /// Finalize verifier and check against candidate signature.
+    #[allow(non_snake_case)]
+    pub fn finalize_and_verify(self) -> Result<(), SignatureError> {
+        let expected_R = self.cr.finish();
+
+        if expected_R == self.sig_R {
+            Ok(())
+        } else {
+            Err(InternalError::Verify.into())
+        }
+    }
+}