Closes#1380, which makes an algebraic argument that the additional
verification step is redundant/tautilogical because it can never fail.
This removes the `VerifyingKey::recover_from_prehash_noverify` method
and gives `VerifyingKey::recover_from_prehash` its previous behavior.
The changes in #1360 were breaking, so this release bumps the minor
version.
It might be possible to get some additional breaking changes in as well,
if we can land RustCrypto/crypto-bigint#1266.
Per #1229: Signature and public-key types lack `Hash`, which prevents
use in `HashMap` / `HashSet` keys and similar collections.
- ecdsa: Signature, DER Signature, SignatureWithOid
- ed25519: Signature, pkcs8::PublicKeyBytes
- ed448: Signature, pkcs8::PublicKeyBytes
- ml-dsa: Signature, VerifyingKey
- slh-dsa: Signature, VerifyingKey
Where a trivial derive works (ed25519, ed448), uses derive. Where
generic bounds or upstream gaps require it, uses a manual impl over
the canonical serialized bytes (`to_bytes` / `encode` / `as_bytes`),
which is the natural Hash domain for these types anyway.
Closes#1229
Releases the following, which all now depend either directly or
transitively on `pkcs8` v0.11 (which had breaking changes in the final
release)
- `dsa` v0.7.0-rc.15
- `ecdsa` v0.17.0-rc.18
- `ed25519` v3.0.0-rc.5
- `ed448` v0.5.0-rc.6
- `ml-dsa` v0.1.0-rc.9
- `slh-dsa` v0.2.0-rc.5
- `xmss` v0.1.0-pre.1
Per maintainer suggestion on #1275, replace the curve-specific
`FieldBytesSize / 2` minimum with an absolute 16-byte / 128-bit
floor. The old rule rejected legitimate pairings like SHA-256 with
P-521 (permitted by e.g. XML Signature); the new rule still catches
egregious digest misuse without those false positives.
Closes#1275
This high-level method can plug into various strategies for efficiently
implementing `aG + bP`, including using basepoint tables, wNAF, or
linear combinations, depending on what crate features are enabled and
what curve-specific optimizations have been implemented.
NOTE: temporarily excludes `slh-dsa` from the workspace until `rand` is
bumped because it is the only crate that depends on it
Release notes:
https://github.com/rust-random/rand_core/releases/tag/v0.10.0
Also bumps the following:
- `chacha20` v0.10.0-rc.10
- `cipher` v0.5.0-rc.7
- `crypto-bigint` v0.7.0-rc.24
- `crypto-common` v0.2.0-rc.14
- `digest` v0.11.0-rc.10
- `elliptic-curve` v0.14.0-rc.27
- `signature` v3.0.0-rc.10
Releases new versions of everything except `dsa` and `ecdsa` (since we
previously released those) which include the `rand_core` v0.10.0-rc-6
upgrade (as well as the associated `signature` v3.0.0-rc.9 release).
The `ml-dsa` crate contains a fix for #1176.
Releases the following:
- `ed25519` v3.0.0-rc.3
- `ed448` v0.5.0-rc.3
- `lms-signature` v0.1.0-rc.1
- `ml-dsa` v0.1.0-rc.4
- `rfc6979` v0.5.0-rc.4
- `slh-dsa` v0.2.0-rc.3
Adds a macro for writing `criterion` benchmarks for ECDSA signing and
verification, similar to other benchmark macros recently added to
`elliptic-curve` and `primeorder`.
The macro should be compatible with both `criterion` v0.7 and v0.8,
allowing for downstream users to ship with MSRV 1.85 support then
upgrade later without requiring breaking changes to this macro.
Adds a `getrandom` feature which allows infallible generation of
`SigningKey`s using the system's cryptographically secure RNG.
Proxies through to the newly added `getrandom` feature in the
`elliptic-curve` crate: RustCrypto/traits#2085
Tony Arcieri