Source: oas/oas/oas-crypto/src/keypair.rs. SHA-256: e48a1d5d5de36a4eeda6ecdd09ec08192fd8d71cd34fd2b7d0a88da97643922b.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

keypair::OasKeyPair

An Ed25519 keypair for an OAS entity.

Holds both the signing (private) and verifying (public) keys. The signing key is zeroized on drop to prevent key material from persisting in memory.

Security

• Private key bytes are never exposed via Debug
• The signing key implements ZeroizeOnDrop
• All signature operations use constant-time comparison

Examples

use oas_crypto::keypair::OasKeyPair;

let keypair = OasKeyPair::generate();
let message = b"hello OAS";
let signature = keypair.sign(message);
assert!(OasKeyPair::verify_with_key(&keypair.verifying_key_bytes(), message, &signature).is_ok());

pub struct OasKeyPair {

}

Source line: 36.

keypair::OasKeyPair::generate

Generates a new random Ed25519 keypair using the OS CSPRNG.

Returns

A fresh [OasKeyPair] with a cryptographically random signing key.

Examples

use oas_crypto::keypair::OasKeyPair;
let kp = OasKeyPair::generate();
assert_eq!(kp.verifying_key_bytes().len(), 32);

pub fn generate() -> Self;

Source line: 76.

keypair::OasKeyPair::from_signing_key_bytes

Constructs an [OasKeyPair] from raw 32-byte signing key material.

The verifying key is automatically derived from the signing key.

Arguments

• bytes - Exactly 32 bytes of Ed25519 signing key material.

Returns

An [OasKeyPair] constructed from the provided key material.

Errors

Returns [CryptoError::InvalidKeyLength] if bytes is not exactly 32 bytes.

Examples

use oas_crypto::keypair::OasKeyPair;
let kp1 = OasKeyPair::generate();
let bytes = kp1.signing_key_bytes();
let kp2 = OasKeyPair::from_signing_key_bytes(&bytes).unwrap();
assert_eq!(kp1.verifying_key_bytes(), kp2.verifying_key_bytes());

pub fn from_signing_key_bytes(bytes: &[u8]) -> Result<Self, CryptoError>;

Source line: 111.

keypair::OasKeyPair::verifying_key_from_bytes

Constructs a verifying-only reference from raw 32-byte public key bytes.

This does NOT create a full keypair — only the public key is available. Use this for signature verification when you don't have the private key.

Arguments

• bytes - Exactly 32 bytes of an Ed25519 verifying (public) key.

Returns

The constructed [VerifyingKey].

Errors

Returns [CryptoError::KeyConstructionFailed] if the bytes are not a valid Ed25519 point.

Examples

use oas_crypto::keypair::OasKeyPair;
let kp = OasKeyPair::generate();
let vk = OasKeyPair::verifying_key_from_bytes(&kp.verifying_key_bytes()).unwrap();
assert_eq!(vk.as_bytes(), &kp.verifying_key_bytes());

pub fn verifying_key_from_bytes(bytes: &[u8]) -> Result<VerifyingKey, CryptoError>;

Source line: 151.

keypair::OasKeyPair::sign

Signs a message with this keypair's signing key.

Arguments

• message - The message bytes to sign.

Returns

A 64-byte Ed25519 signature.

Examples

use oas_crypto::keypair::OasKeyPair;
let kp = OasKeyPair::generate();
let sig = kp.sign(b"message");
assert_eq!(sig.len(), 64);

pub fn sign(&self, message: &[u8]) -> Vec<u8>;

Source line: 181.

keypair::OasKeyPair::verify_with_key

Verifies an Ed25519 signature against a public key.

Uses constant-time comparison internally (provided by ed25519-dalek).

Arguments

• public_key_bytes - The 32-byte Ed25519 verifying key.
• message - The original message that was signed.
• signature_bytes - The 64-byte Ed25519 signature.

Returns

Ok(()) if the signature is valid.

Errors

Returns [CryptoError::InvalidSignature] if verification fails. Returns [CryptoError::InvalidKeyLength] if key/signature bytes are wrong length.

Examples

use oas_crypto::keypair::OasKeyPair;
let kp = OasKeyPair::generate();
let sig = kp.sign(b"test");
assert!(OasKeyPair::verify_with_key(&kp.verifying_key_bytes(), b"test", &sig).is_ok());
assert!(OasKeyPair::verify_with_key(&kp.verifying_key_bytes(), b"wrong", &sig).is_err());

pub fn verify_with_key(
        public_key_bytes: &[u8],
        message: &[u8],
        signature_bytes: &[u8],
    ) -> Result<(), CryptoError>;

Source line: 214.

keypair::OasKeyPair::signing_key_bytes

Returns the raw 32-byte signing (private) key bytes.

Security

Handle with extreme care. Never log, serialize, or transmit this value. The returned array should be zeroized after use.

pub fn signing_key_bytes(&self) -> [u8; 32];

Source line: 240.

keypair::OasKeyPair::verifying_key_bytes

Returns the raw 32-byte verifying (public) key bytes.

pub fn verifying_key_bytes(&self) -> [u8; 32];

Source line: 245.

keypair::OasKeyPair::public_key_multibase

Returns the public key encoded as multibase base58btc (with z prefix).

This is the canonical format for publicKeyMultibase in OAS Identity Documents.

Examples

use oas_crypto::keypair::OasKeyPair;
let kp = OasKeyPair::generate();
let mb = kp.public_key_multibase();
assert!(mb.starts_with('z'));

pub fn public_key_multibase(&self) -> String;

Source line: 261.

keypair::OasKeyPair::signing_key

Returns a reference to the inner ed25519-dalek [SigningKey].

pub fn signing_key(&self) -> &SigningKey;

Source line: 266.

keypair::OasKeyPair::verifying_key

Returns a reference to the inner ed25519-dalek [VerifyingKey].

pub fn verifying_key(&self) -> &VerifyingKey;

Source line: 271.