ecdsa: use blanket impl from signature 3 (#945)

- Renames `DigestPrimitive` to `DigestAlgorithm` - `DigestAlgorithm` now exported from crate root instead of `hazmat`
2026-06-21 13:45:42 +00:00 · 2025-04-23 09:58:24 -07:00
parent a83c494216
commit 8e6bb26c26
14 changed files with 125 additions and 233 deletions
@@ -94,7 +94,7 @@ version = "0.11.0-rc.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a229bfd78e4827c91b9b95784f69492c1b77c1ab75a45a8a037b139215086f94"
 dependencies = [
- "hybrid-array 0.3.0",
+ "hybrid-array",
 ]

 [[package]]
@@ -267,10 +267,11 @@ checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"

 [[package]]
 name = "crypto-bigint"
-version = "0.7.0-pre"
-source = "git+https://github.com/RustCrypto/crypto-bigint.git#534c2940b1f0aa9ec8ada964ce654cc0e6e1e7bb"
+version = "0.7.0-pre.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6957fb7344601c8271b03e9d4c7efb46f1dee86553eee20f99e54db0cf53f36e"
 dependencies = [
- "hybrid-array 0.2.3",
+ "hybrid-array",
 "num-traits",
 "rand_core 0.9.2",
 "subtle",
@@ -283,7 +284,7 @@ version = "0.2.0-rc.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "170d71b5b14dec99db7739f6fc7d6ec2db80b78c3acb77db48392ccc3d8a9ea0"
 dependencies = [
- "hybrid-array 0.3.0",
+ "hybrid-array",
 ]

 [[package]]
@@ -329,7 +330,7 @@ dependencies = [
 "rfc6979",
 "serdect",
 "sha2",
- "signature",
+ "signature 3.0.0-pre",
 "spki",
 ]

@@ -343,7 +344,7 @@ dependencies = [
 "rand_core 0.9.2",
 "serde",
 "serde_bytes",
- "signature",
+ "signature 3.0.0-pre",
 "zeroize",
 ]

@@ -356,7 +357,7 @@ dependencies = [
 "pkcs8",
 "serde",
 "serde_bytes",
- "signature",
+ "signature 3.0.0-pre",
 "zeroize",
 ]

@@ -369,7 +370,7 @@ checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
 [[package]]
 name = "elliptic-curve"
 version = "0.14.0-rc.1"
-source = "git+https://github.com/RustCrypto/traits.git#829328e9405143cc86b81c297b39f1a6161700c8"
+source = "git+https://github.com/RustCrypto/traits.git#ba9dbacd95e51200b697ca6f7dfdfc200129b3d6"
 dependencies = [
 "base16ct",
 "crypto-bigint",
@@ -377,7 +378,7 @@ dependencies = [
 "ff",
 "group",
 "hex-literal 1.0.0",
- "hybrid-array 0.3.0",
+ "hybrid-array",
 "pem-rfc7468",
 "pkcs8",
 "rand_core 0.9.2",
@@ -509,15 +510,6 @@ dependencies = [
 "digest",
 ]

-[[package]]
-name = "hybrid-array"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2d35805454dc9f8662a98d6d61886ffe26bd465f5960e0e55345c70d5c0d2a9"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "hybrid-array"
 version = "0.3.0"
@@ -534,7 +526,7 @@ version = "0.2.0-rc.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac5e145e8ade9f74c0a5efc60ccb4e714b0144f7e2220b7ca64254feee71c57f"
 dependencies = [
- "hybrid-array 0.3.0",
+ "hybrid-array",
 ]

 [[package]]
@@ -612,11 +604,11 @@ dependencies = [
 "digest",
 "hex",
 "hex-literal 0.4.1",
- "hybrid-array 0.3.0",
+ "hybrid-array",
 "rand 0.9.0",
 "rand_core 0.9.2",
 "sha2",
- "signature",
+ "signature 3.0.0-pre",
 "static_assertions",
 "typenum",
 "zeroize",
@@ -642,7 +634,7 @@ dependencies = [
 "criterion",
 "hex",
 "hex-literal 1.0.0",
- "hybrid-array 0.3.0",
+ "hybrid-array",
 "num-traits",
 "pkcs8",
 "proptest",
@@ -651,7 +643,7 @@ dependencies = [
 "serde",
 "serde_json",
 "sha3",
- "signature",
+ "signature 2.3.0-pre.7",
 "zeroize",
 ]

@@ -1007,7 +999,7 @@ checksum = "a017a4aa8f0bd51e9d0184d98042dfe9285218fec098493f47d9a8aa0f1a3f27"
 dependencies = [
 "base16ct",
 "der",
- "hybrid-array 0.3.0",
+ "hybrid-array",
 "pkcs8",
 "serdect",
 "subtle",
@@ -1091,6 +1083,14 @@ name = "signature"
 version = "2.3.0-pre.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6e22be6d22b655ff65ed5635383d63ac17a99c5c0a05a83a414d399056d4e1d"
+dependencies = [
+ "rand_core 0.9.2",
+]
+
+[[package]]
+name = "signature"
+version = "3.0.0-pre"
+source = "git+https://github.com/RustCrypto/traits.git#bf4774878c7c2e36451119a0ad24f1db6dc93cd8"
 dependencies = [
 "digest",
 "rand_core 0.9.2",
@@ -1109,7 +1109,7 @@ dependencies = [
 "hex",
 "hex-literal 1.0.0",
 "hmac",
- "hybrid-array 0.3.0",
+ "hybrid-array",
 "num-bigint",
 "paste",
 "pkcs8",
@@ -1122,7 +1122,7 @@ dependencies = [
 "serde_json",
 "sha2",
 "sha3",
- "signature",
+ "signature 3.0.0-pre",
 "typenum",
 "zerocopy 0.7.35",
 "zeroize",
@@ -34,7 +34,4 @@ slh-dsa         = { path = "./slh-dsa" }
 # https://github.com/RustCrypto/traits/pull/1774
 # https://github.com/RustCrypto/traits/pull/1822
 elliptic-curve = { git = "https://github.com/RustCrypto/traits.git" }
-
-# https://github.com/RustCrypto/crypto-bigint/pull/762
-# https://github.com/RustCrypto/crypto-bigint/pull/765
-crypto-bigint = { git = "https://github.com/RustCrypto/crypto-bigint.git" }
+signature      = { git = "https://github.com/RustCrypto/traits.git" }
@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## 0.17.0 (UNRELEASED)
+
+### Changed
+- `DigestPrimitive` was moved off of hazmat ([#945])
+- `DigestPrimitive` has been renamed `DigestAlgorithm` ([#945])
+
+[#945]: https://github.com/RustCrypto/signatures/pull/945
+
 ## 0.16.9 (2023-11-16)
 ### Changed
 - Loosen `signature` bound to `2.0, <2.3` ([#756])
@@ -18,7 +18,7 @@ rust-version = "1.85"

 [dependencies]
 elliptic-curve = { version = "0.14.0-rc.1", default-features = false, features = ["sec1"] }
-signature = { version = "=2.3.0-pre.7", default-features = false, features = ["rand_core"] }
+signature = { version = "=3.0.0-pre", default-features = false, features = ["rand_core"] }

 # optional dependencies
 der = { version = "0.8.0-rc.1", optional = true }
@@ -44,6 +44,7 @@ digest = ["dep:digest", "elliptic-curve/digest", "signature/digest"]
 hazmat = []
 pkcs8 = ["digest", "elliptic-curve/pkcs8", "der"]
 pem = ["elliptic-curve/pem", "pkcs8"]
+rfc6979 = ["arithmetic", "digest", "dep:rfc6979"]
 serde = ["elliptic-curve/serde", "pkcs8", "serdect"]
 signing = ["arithmetic", "digest", "hazmat", "rfc6979"]
 verifying = ["arithmetic", "digest", "hazmat"]
@@ -382,10 +382,10 @@ fn find_scalar_range(outer: &[u8], inner: &[u8]) -> Result<Range<usize>> {
    Ok(Range { start, end })
 }

-#[cfg(all(feature = "digest", feature = "hazmat"))]
+#[cfg(feature = "digest")]
 impl<C> signature::PrehashSignature for Signature<C>
 where
-    C: EcdsaCurve + crate::hazmat::DigestPrimitive,
+    C: EcdsaCurve + crate::DigestAlgorithm,
    MaxSize<C>: ArraySize,
    <FieldBytesSize<C> as Add>::Output: Add<MaxOverhead> + ArraySize,
 {
@@ -27,46 +27,21 @@ use {
    },
 };

-#[cfg(feature = "digest")]
+#[cfg(feature = "rfc6979")]
 use {
-    elliptic_curve::FieldBytesSize,
-    signature::{
-        PrehashSignature,
-        digest::{Digest, FixedOutput, FixedOutputReset, core_api::BlockSizeUser},
-    },
+    elliptic_curve::FieldBytesEncoding,
+    signature::digest::{Digest, FixedOutput, FixedOutputReset, core_api::BlockSizeUser},
 };

-#[cfg(feature = "rfc6979")]
-use elliptic_curve::FieldBytesEncoding;
-
-#[cfg(any(feature = "arithmetic", feature = "digest"))]
+#[cfg(any(feature = "arithmetic", feature = "rfc6979"))]
 use crate::{Signature, elliptic_curve::array::ArraySize};

-/// Bind a preferred [`Digest`] algorithm to an elliptic curve type.
-///
-/// Generally there is a preferred variety of the SHA-2 family used with ECDSA
-/// for a particular elliptic curve.
-///
-/// This trait can be used to specify it, and with it receive a blanket impl of
-/// [`PrehashSignature`], used by [`signature_derive`][1]) for the [`Signature`]
-/// type for a particular elliptic curve.
-///
-/// [1]: https://github.com/RustCrypto/traits/tree/master/signature/derive
 #[cfg(feature = "digest")]
-pub trait DigestPrimitive: EcdsaCurve {
-    /// Preferred digest to use when computing ECDSA signatures for this
-    /// elliptic curve. This is typically a member of the SHA-2 family.
-    type Digest: BlockSizeUser + Digest + FixedOutput + FixedOutputReset;
-}
-
-#[cfg(feature = "digest")]
-impl<C> PrehashSignature for Signature<C>
-where
-    C: DigestPrimitive,
-    <FieldBytesSize<C> as core::ops::Add>::Output: ArraySize,
-{
-    type Digest = C::Digest;
-}
+#[deprecated(
+    since = "0.17.0",
+    note = "`DigestAlgorithm` is no longer in `hazmat`, please use `ecdsa::DigestAlgorithm` instead"
+)]
+pub use crate::DigestAlgorithm;

 /// Partial implementation of the `bits2int` function as defined in
 /// [RFC6979 § 2.3.2] as well as [SEC1] § 2.3.8.
@@ -101,9 +101,13 @@ use {
 };

 #[cfg(feature = "digest")]
-use digest::{
-    Digest,
-    const_oid::{AssociatedOid, ObjectIdentifier},
+use {
+    digest::{
+        Digest, FixedOutput, FixedOutputReset,
+        const_oid::{AssociatedOid, ObjectIdentifier},
+        core_api::BlockSizeUser,
+    },
+    signature::PrehashSignature,
 };

 #[cfg(feature = "pkcs8")]
@@ -463,15 +467,15 @@ where
 ///
 /// To support non-default digest algorithms, use the [`SignatureWithOid`]
 /// type instead.
-#[cfg(all(feature = "digest", feature = "hazmat"))]
+#[cfg(feature = "digest")]
 impl<C> AssociatedOid for Signature<C>
 where
-    C: hazmat::DigestPrimitive,
+    C: DigestAlgorithm,
    C::Digest: AssociatedOid,
 {
    const OID: ObjectIdentifier = match ecdsa_oid_for_digest(C::Digest::OID) {
        Some(oid) => oid,
-        None => panic!("no RFC5758 ECDSA OID defined for DigestPrimitive::Digest"),
+        None => panic!("no RFC5758 ECDSA OID defined for DigestAlgorithm::Digest"),
    };
 }

@@ -713,14 +717,14 @@ where
 }

 /// NOTE: this implementation assumes the default digest for the given elliptic
-/// curve as defined by [`hazmat::DigestPrimitive`].
+/// curve as defined by [`DigestAlgorithm`].
 ///
 /// When working with alternative digests, you will need to use e.g.
 /// [`SignatureWithOid::new_with_digest`].
-#[cfg(all(feature = "digest", feature = "hazmat"))]
+#[cfg(feature = "digest")]
 impl<C> SignatureEncoding for SignatureWithOid<C>
 where
-    C: hazmat::DigestPrimitive,
+    C: DigestAlgorithm,
    C::Digest: AssociatedOid,
    SignatureSize<C>: ArraySize,
 {
@@ -728,14 +732,14 @@ where
 }

 /// NOTE: this implementation assumes the default digest for the given elliptic
-/// curve as defined by [`hazmat::DigestPrimitive`].
+/// curve as defined by [`DigestAlgorithm`].
 ///
 /// When working with alternative digests, you will need to use e.g.
 /// [`SignatureWithOid::new_with_digest`].
-#[cfg(all(feature = "digest", feature = "hazmat"))]
+#[cfg(feature = "digest")]
 impl<C> TryFrom<&[u8]> for SignatureWithOid<C>
 where
-    C: hazmat::DigestPrimitive,
+    C: DigestAlgorithm,
    C::Digest: AssociatedOid,
    SignatureSize<C>: ArraySize,
 {
@@ -770,3 +774,29 @@ const fn ecdsa_oid_for_digest(digest_oid: ObjectIdentifier) -> Option<ObjectIden
        _ => None,
    }
 }
+
+/// Bind a preferred [`Digest`] algorithm to an elliptic curve type.
+///
+/// Generally there is a preferred variety of the SHA-2 family used with ECDSA
+/// for a particular elliptic curve.
+///
+/// This trait can be used to specify it, and with it receive a blanket impl of
+/// [`PrehashSignature`], used by [`signature_derive`][1]) for the [`Signature`]
+/// type for a particular elliptic curve.
+///
+/// [1]: https://github.com/RustCrypto/traits/tree/master/signature/derive
+#[cfg(feature = "digest")]
+pub trait DigestAlgorithm: EcdsaCurve {
+    /// Preferred digest to use when computing ECDSA signatures for this
+    /// elliptic curve. This is typically a member of the SHA-2 family.
+    type Digest: BlockSizeUser + Digest + FixedOutput + FixedOutputReset;
+}
+
+#[cfg(feature = "digest")]
+impl<C> PrehashSignature for Signature<C>
+where
+    C: DigestAlgorithm,
+    <FieldBytesSize<C> as Add>::Output: ArraySize,
+{
+    type Digest = C::Digest;
+}
@@ -7,7 +7,7 @@ use {
    crate::{SigningKey, hazmat::sign_prehashed_rfc6979},
    elliptic_curve::{FieldBytes, subtle::CtOption},
    signature::{
-        DigestSigner, RandomizedDigestSigner, Signer,
+        DigestSigner, RandomizedDigestSigner,
        digest::FixedOutput,
        hazmat::{PrehashSigner, RandomizedPrehashSigner},
        rand_core::TryCryptoRng,
@@ -28,10 +28,7 @@ use {

 #[cfg(any(feature = "signing", feature = "verifying"))]
 use {
-    crate::{
-        EcdsaCurve, Signature, SignatureSize,
-        hazmat::{DigestPrimitive, bits2field},
-    },
+    crate::{DigestAlgorithm, EcdsaCurve, Signature, SignatureSize, hazmat::bits2field},
    elliptic_curve::{CurveArithmetic, Scalar, array::ArraySize, ops::Invert},
    signature::digest::Digest,
 };
@@ -100,7 +97,7 @@ impl RecoveryId {
        signature: &Signature<C>,
    ) -> Result<Self>
    where
-        C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+        C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
        AffinePoint<C>: DecompressPoint<C> + FromEncodedPoint<C> + ToEncodedPoint<C>,
        FieldBytesSize<C>: sec1::ModulusSize,
        SignatureSize<C>: ArraySize,
@@ -179,7 +176,7 @@ impl From<RecoveryId> for u8 {
 #[cfg(feature = "signing")]
 impl<C> SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
 {
@@ -220,7 +217,7 @@ where
 #[cfg(feature = "signing")]
 impl<C, D> DigestSigner<D, (Signature<C>, RecoveryId)> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    D: Digest,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
@@ -233,7 +230,7 @@ where
 #[cfg(feature = "signing")]
 impl<C> RandomizedPrehashSigner<(Signature<C>, RecoveryId)> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
 {
@@ -249,7 +246,7 @@ where
 #[cfg(feature = "signing")]
 impl<C, D> RandomizedDigestSigner<D, (Signature<C>, RecoveryId)> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    D: Digest + FixedOutput,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
@@ -266,7 +263,7 @@ where
 #[cfg(feature = "signing")]
 impl<C> PrehashSigner<(Signature<C>, RecoveryId)> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
 {
@@ -275,18 +272,6 @@ where
    }
 }

-#[cfg(feature = "signing")]
-impl<C> Signer<(Signature<C>, RecoveryId)> for SigningKey<C>
-where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
-    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
-    SignatureSize<C>: ArraySize,
-{
-    fn try_sign(&self, msg: &[u8]) -> Result<(Signature<C>, RecoveryId)> {
-        self.sign_recoverable(msg)
-    }
-}
-
 #[cfg(feature = "verifying")]
 impl<C> VerifyingKey<C>
 where
@@ -298,14 +283,14 @@ where
    /// Recover a [`VerifyingKey`] from the given message, signature, and
    /// [`RecoveryId`].
    ///
-    /// The message is first hashed using this curve's [`DigestPrimitive`].
+    /// The message is first hashed using this curve's [`DigestAlgorithm`].
    pub fn recover_from_msg(
        msg: &[u8],
        signature: &Signature<C>,
        recovery_id: RecoveryId,
    ) -> Result<Self>
    where
-        C: DigestPrimitive,
+        C: DigestAlgorithm,
    {
        Self::recover_from_digest(C::Digest::new_with_prefix(msg), signature, recovery_id)
    }
@@ -1,8 +1,9 @@
 //! ECDSA signing: producing signatures using a [`SigningKey`].

 use crate::{
-    EcdsaCurve, Error, Result, Signature, SignatureSize, SignatureWithOid, ecdsa_oid_for_digest,
-    hazmat::{DigestPrimitive, bits2field, sign_prehashed_rfc6979},
+    DigestAlgorithm, EcdsaCurve, Error, Result, Signature, SignatureSize, SignatureWithOid,
+    ecdsa_oid_for_digest,
+    hazmat::{bits2field, sign_prehashed_rfc6979},
 };
 use core::fmt::{self, Debug};
 use digest::{Digest, FixedOutput, const_oid::AssociatedOid};
@@ -15,7 +16,7 @@ use elliptic_curve::{
    zeroize::{Zeroize, ZeroizeOnDrop},
 };
 use signature::{
-    DigestSigner, RandomizedDigestSigner, RandomizedSigner, Signer,
+    DigestSigner, RandomizedDigestSigner, Signer,
    hazmat::{PrehashSigner, RandomizedPrehashSigner},
    rand_core::{CryptoRng, TryCryptoRng},
 };
@@ -139,7 +140,7 @@ where
 /// [RFC6979 § 3.2]: https://tools.ietf.org/html/rfc6979#section-3
 impl<C, D> DigestSigner<D, Signature<C>> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    D: Digest + FixedOutput,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
@@ -155,7 +156,7 @@ where
 /// [RFC6979 § 3.2]: https://tools.ietf.org/html/rfc6979#section-3
 impl<C> PrehashSigner<Signature<C>> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
 {
@@ -165,24 +166,9 @@ where
    }
 }

-/// Sign message using a deterministic ephemeral scalar (`k`)
-/// computed using the algorithm described in [RFC6979 § 3.2].
-///
-/// [RFC6979 § 3.2]: https://tools.ietf.org/html/rfc6979#section-3
-impl<C> Signer<Signature<C>> for SigningKey<C>
-where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
-    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
-    SignatureSize<C>: ArraySize,
-{
-    fn try_sign(&self, msg: &[u8]) -> Result<Signature<C>> {
-        self.try_sign_digest(C::Digest::new_with_prefix(msg))
-    }
-}
-
 impl<C, D> RandomizedDigestSigner<D, Signature<C>> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    D: Digest + FixedOutput,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
@@ -198,7 +184,7 @@ where

 impl<C> RandomizedPrehashSigner<Signature<C>> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
 {
@@ -214,25 +200,9 @@ where
    }
 }

-impl<C> RandomizedSigner<Signature<C>> for SigningKey<C>
-where
-    Self: RandomizedDigestSigner<C::Digest, Signature<C>>,
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
-    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
-    SignatureSize<C>: ArraySize,
-{
-    fn try_sign_with_rng<R: TryCryptoRng + ?Sized>(
-        &self,
-        rng: &mut R,
-        msg: &[u8],
-    ) -> Result<Signature<C>> {
-        self.try_sign_digest_with_rng(rng, C::Digest::new_with_prefix(msg))
-    }
-}
-
 impl<C, D> DigestSigner<D, SignatureWithOid<C>> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    D: AssociatedOid + Digest + FixedOutput,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
@@ -246,7 +216,7 @@ where

 impl<C> Signer<SignatureWithOid<C>> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    C::Digest: AssociatedOid,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
@@ -259,7 +229,7 @@ where
 #[cfg(feature = "der")]
 impl<C> PrehashSigner<der::Signature<C>> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
    der::MaxSize<C>: ArraySize,
@@ -270,44 +240,10 @@ where
    }
 }

-#[cfg(feature = "der")]
-impl<C> Signer<der::Signature<C>> for SigningKey<C>
-where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
-    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
-    SignatureSize<C>: ArraySize,
-    der::MaxSize<C>: ArraySize,
-    <FieldBytesSize<C> as Add>::Output: Add<der::MaxOverhead> + ArraySize,
-{
-    fn try_sign(&self, msg: &[u8]) -> Result<der::Signature<C>> {
-        Signer::<Signature<C>>::try_sign(self, msg).map(Into::into)
-    }
-}
-
-#[cfg(feature = "der")]
-impl<C, D> RandomizedDigestSigner<D, der::Signature<C>> for SigningKey<C>
-where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
-    D: Digest + FixedOutput,
-    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
-    SignatureSize<C>: ArraySize,
-    der::MaxSize<C>: ArraySize,
-    <FieldBytesSize<C> as Add>::Output: Add<der::MaxOverhead> + ArraySize,
-{
-    fn try_sign_digest_with_rng<R: TryCryptoRng + ?Sized>(
-        &self,
-        rng: &mut R,
-        msg_digest: D,
-    ) -> Result<der::Signature<C>> {
-        RandomizedDigestSigner::<D, Signature<C>>::try_sign_digest_with_rng(self, rng, msg_digest)
-            .map(Into::into)
-    }
-}
-
 #[cfg(feature = "der")]
 impl<C> RandomizedPrehashSigner<der::Signature<C>> for SigningKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
    SignatureSize<C>: ArraySize,
    der::MaxSize<C>: ArraySize,
@@ -323,24 +259,6 @@ where
    }
 }

-#[cfg(feature = "der")]
-impl<C> RandomizedSigner<der::Signature<C>> for SigningKey<C>
-where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
-    Scalar<C>: Invert<Output = CtOption<Scalar<C>>>,
-    SignatureSize<C>: ArraySize,
-    der::MaxSize<C>: ArraySize,
-    <FieldBytesSize<C> as Add>::Output: Add<der::MaxOverhead> + ArraySize,
-{
-    fn try_sign_with_rng<R: TryCryptoRng + ?Sized>(
-        &self,
-        rng: &mut R,
-        msg: &[u8],
-    ) -> Result<der::Signature<C>> {
-        RandomizedSigner::<Signature<C>>::try_sign_with_rng(self, rng, msg).map(Into::into)
-    }
-}
-
 //
 // Other trait impls
 //
@@ -2,7 +2,7 @@

 use crate::{
    EcdsaCurve, Error, Result, Signature, SignatureSize,
-    hazmat::{self, DigestPrimitive, bits2field},
+    hazmat::{self, bits2field},
 };
 use core::{cmp::Ordering, fmt::Debug};
 use elliptic_curve::{
@@ -13,7 +13,7 @@ use elliptic_curve::{
    sec1::{self, CompressedPoint, EncodedPoint, FromEncodedPoint, ToEncodedPoint},
 };
 use signature::{
-    DigestVerifier, Verifier,
+    DigestVerifier,
    digest::{Digest, FixedOutput},
    hazmat::PrehashVerifier,
 };
@@ -42,9 +42,11 @@ use serdect::serde::{Deserialize, Serialize, de, ser};
 #[cfg(feature = "sha2")]
 use {
    crate::{
-        ECDSA_SHA224_OID, ECDSA_SHA256_OID, ECDSA_SHA384_OID, ECDSA_SHA512_OID, SignatureWithOid,
+        DigestAlgorithm, ECDSA_SHA224_OID, ECDSA_SHA256_OID, ECDSA_SHA384_OID, ECDSA_SHA512_OID,
+        SignatureWithOid,
    },
    sha2::{Sha224, Sha256, Sha384, Sha512},
+    signature::Verifier,
 };

 #[cfg(all(feature = "alloc", feature = "pkcs8"))]
@@ -172,20 +174,10 @@ where
    }
 }

-impl<C> Verifier<Signature<C>> for VerifyingKey<C>
-where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
-    SignatureSize<C>: ArraySize,
-{
-    fn verify(&self, msg: &[u8], signature: &Signature<C>) -> Result<()> {
-        self.verify_digest(C::Digest::new_with_prefix(msg), signature)
-    }
-}
-
 #[cfg(feature = "sha2")]
 impl<C> Verifier<SignatureWithOid<C>> for VerifyingKey<C>
 where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
+    C: EcdsaCurve + CurveArithmetic + DigestAlgorithm,
    SignatureSize<C>: ArraySize,
 {
    fn verify(&self, msg: &[u8], sig: &SignatureWithOid<C>) -> Result<()> {
@@ -228,20 +220,6 @@ where
    }
 }

-#[cfg(feature = "der")]
-impl<C> Verifier<der::Signature<C>> for VerifyingKey<C>
-where
-    C: EcdsaCurve + CurveArithmetic + DigestPrimitive,
-    SignatureSize<C>: ArraySize,
-    der::MaxSize<C>: ArraySize,
-    <FieldBytesSize<C> as Add>::Output: Add<der::MaxOverhead> + ArraySize,
-{
-    fn verify(&self, msg: &[u8], signature: &der::Signature<C>) -> Result<()> {
-        let signature = Signature::<C>::try_from(signature.clone())?;
-        Verifier::<Signature<C>>::verify(self, msg, &signature)
-    }
-}
-
 //
 // Other trait impls
 //
@@ -18,8 +18,8 @@ edition = "2024"
 rust-version = "1.85"

 [dependencies]
-# TODO(tarcieri): relax requirement back to `2` before next release
-signature = { version = "=2.3.0-pre.7", default-features = false }
+# TODO(tarcieri): relax requirement back to `3` before next release
+signature = { version = "=3.0.0-pre", default-features = false }

 # optional dependencies
 pkcs8 = { version = "0.11.0-rc.2", optional = true }
@@ -18,8 +18,8 @@ keywords = ["crypto", "curve448", "ecc", "signature", "signing"]
 rust-version = "1.85"

 [dependencies]
-# TODO(tarcieri): relax requirement back to `2` before next release
-signature = { version = "=2.3.0-pre.7", default-features = false }
+# TODO(tarcieri): relax requirement back to `3` before next release
+signature = { version = "=3.0.0-pre", default-features = false }

 # optional dependencies
 pkcs8 = { version = "0.11.0-rc.1", optional = true }
@@ -18,7 +18,7 @@ rand = "0.9.0"
 sha2 = "=0.11.0-pre.5"
 static_assertions = "1.1.0"
 rand_core = "0.9.0"
-signature = { version = "=2.3.0-pre.7", features = ["digest", "std", "rand_core"] }
+signature = { version = "=3.0.0-pre", features = ["digest", "std", "rand_core"] }
 typenum = { version = "1.17.0", features = ["const-generics"] }
 zeroize = "1.8.1"

@@ -21,7 +21,7 @@ typenum = { version = "1.17.0", features = ["const-generics"] }
 sha3 = { version = "=0.11.0-pre.5", default-features = false }
 zerocopy = { version = "0.7.34", features = ["derive"] }
 rand_core = { version = "0.9.2" }
-signature = { version = "=2.3.0-pre.7", features = ["rand_core"] }
+signature = { version = "=3.0.0-pre", features = ["rand_core"] }
 hmac = "=0.13.0-pre.5"
 sha2 = { version = "=0.11.0-pre.5", default-features = false }
 digest = "=0.11.0-pre.10"