rok::core::crypto::ecdsa
ECDSA (FIPS 186-5) on P-256 and P-384: verification, and signing
with RFC 6979 deterministic nonces. Field elements are fixed arrays
of 32-bit limbs ([u32; 12], P-256 uses the low 8) in Montgomery
form, so arithmetic allocates nothing. Points are projective
(X : Y : Z) with the complete formulas of Renes, Costello and Batina
(2016, algorithms 4 and 6, a = -3), which handle doubling and the
identity (0 : 1 : 0) without special cases.
Signing runs in constant time: the scalar multiplication reads its table with a masked scan, inversions are Fermat powers with a public exponent, carries and reductions are masks. Verification sees public data only and indexes its tables by scalar digits.
Structs
Ecdsa
pub struct Ecdsapub fn public_key(curve: EcCurve, private_key: Bytes) throws (ValueError) -> List<u8>The SEC1 uncompressed public key of
private_key(a big-endian scalar of at most the curve's size).pub fn sign(curve: EcCurve, hash: HashAlgorithm, private_key: Bytes, msg: Bytes) throws (ValueError) -> List<u8>A DER signature of
msg, hashed withhash, byprivate_key; the nonce is derived per RFC 6979 (HMAC-DRBG withhash).pub fn verify(curve: EcCurve, hash: HashAlgorithm, public_key: Bytes, msg: Bytes, signature: Bytes) -> boolWhether
signature(DER) is a signature ofmsg, hashed withhash, underpublic_key(SEC1 uncompressed point).
Enums
EcCurve
pub enum EcCurveP256P384