Struct SigningKey 

pub struct SigningKey {
    pub(super) id: KeyId,
    inner: RawSigningKey,
}

A signing key is a private key used for signing data. An associated VerifyingKey can be derived from it.

Fields

id: KeyId

inner: RawSigningKey

Implementations

impl SigningKey

fn sign_bytes( &self, serialized_message: &SerializedMessage, namespace: &SigningNamespace, ) -> Result<SignedObject, CryptoError>

Signs the given payload with the signing key, under a given namespace. This is is the underlying implementation of the sign method, and takes a raw byte array as input.

pub fn sign<Message: Serialize>( &self, message: &Message, namespace: &SigningNamespace, ) -> Result<SignedObject, CryptoError>

Signs the given payload with the signing key, under a given namespace. This returns a SignedObject object, that contains the payload. The payload is included in the signature, and does not need to be provided when verifying the signature.

This should be used when only one signer is required, so that only one object needs to be kept track of.

use bitwarden_crypto::{SigningNamespace, SignatureAlgorithm, SigningKey};
use serde::{Serialize, Deserialize};

const EXAMPLE_NAMESPACE: SigningNamespace = SigningNamespace::SignedPublicKey;

#[derive(Serialize, Deserialize, Debug, PartialEq)]
struct TestMessage {
  field1: String,
}

let signing_key = SigningKey::make(SignatureAlgorithm::Ed25519);
let message = TestMessage {
  field1: "Test message".to_string(),
};
let namespace = EXAMPLE_NAMESPACE;
let signed_object = signing_key.sign(&message, &namespace).unwrap();
// The signed object can be verified using the verifying key:
let verifying_key = signing_key.to_verifying_key();
let payload: TestMessage = signed_object.verify_and_unwrap(&verifying_key, &namespace).unwrap();
assert_eq!(payload, message);

impl SigningKey

pub fn sign_detached<Message: Serialize>( &self, message: &Message, namespace: &SigningNamespace, ) -> Result<(Signature, SerializedMessage), CryptoError>

Signs the given payload with the signing key, under a given SigningNamespace. This returns a Signature object, that does not contain the payload. The payload must be stored separately, and needs to be provided when verifying the signature.

This should be used when multiple signers are required, or when signatures need to be replaceable without re-uploading the object, or if the signed object should be parseable by the server side, without the use of COSE on the server.

use bitwarden_crypto::{SigningNamespace, SignatureAlgorithm, SigningKey};
use serde::{Serialize, Deserialize};

const EXAMPLE_NAMESPACE: SigningNamespace = SigningNamespace::SignedPublicKey;

#[derive(Serialize, Deserialize, Debug, PartialEq)]
struct TestMessage {
 field1: String,
}

let signing_key = SigningKey::make(SignatureAlgorithm::Ed25519);
let message = TestMessage {
 field1: "Test message".to_string(),
};
let namespace = EXAMPLE_NAMESPACE;
let (signature, serialized_message) = signing_key.sign_detached(&message, &namespace).unwrap();
// Verification
let verifying_key = signing_key.to_verifying_key();
assert!(signature.verify(&serialized_message.as_bytes(), &verifying_key, &namespace));

pub fn counter_sign_detached( &self, serialized_message_bytes: Vec<u8>, initial_signature: &Signature, namespace: &SigningNamespace, ) -> Result<Signature, CryptoError>

Given a serialized message, signature, this counter-signs the message. That is, if multiple parties want to sign the same message, one party creates the initial message, and the other parties then counter-sign it, and submit their signatures. This can be done as follows: ``` let alice_key = SigningKey::make(SignatureAlgorithm::Ed25519); let bob_key = SigningKey::make(SignatureAlgorithm::Ed25519);

let message = TestMessage { field1: “Test message”.to_string(), }; let namespace = SigningNamespace::ExampleNamespace; let (signature, serialized_message) = alice_key.sign_detached(&message, &namespace).unwrap();\ // Alice shares (signature, serialized_message) with Bob. // Bob verifies the contents of serialized_message using application logic, then signs it: let (bob_signature, serialized_message) = bob_key.counter_sign(&serialized_message, &signature, &namespace).unwrap(); ```

fn sign_detached_bytes( &self, message: &SerializedMessage, namespace: &SigningNamespace, ) -> Signature

Signs the given payload with the signing key, under a given namespace. This is is the underlying implementation of the sign_detached method, and takes a raw byte array as input.

impl SigningKey

pub fn make(algorithm: SignatureAlgorithm) -> Self

Makes a new signing key for the given signature scheme.

pub(super) fn cose_algorithm(&self) -> Algorithm

pub fn to_verifying_key(&self) -> VerifyingKey

Derives the verifying key from the signing key. The key id is the same for the signing and verifying key, since they are a pair.

pub(super) fn sign_raw(&self, data: &[u8]) -> Vec<u8>

Signs the given byte array with the signing key. This should not be used directly other than for generating namespace separated signatures or signed objects.

Trait Implementations

impl Clone for SigningKey

fn clone(&self) -> SigningKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CoseSerializable<CoseKeyContentFormat> for SigningKey

fn to_cose(&self) -> CoseKeyBytes

Serializes the signing key to a COSE-formatted byte array.

fn from_cose(bytes: &CoseKeyBytes) -> Result<Self, EncodingError>

Deserializes a COSE-formatted byte array into a signing key.

impl CryptoKey for SigningKey

impl ZeroizeOnDrop for SigningKey