#hustcer/ed25519

#Module

{
  "deps": {
    "hustcer/ed25519": "0.3.0"
  }
}

import {
  "hustcer/ed25519" @ed25519,
}

#API

pub fn derive_public_key(BytesView) -> Result[Bytes, String]
pub fn sign(BytesView, BytesView) -> Result[Bytes, String]
pub fn verify(BytesView, BytesView, BytesView) -> Bool
pub fn verify_result(BytesView, BytesView, BytesView) -> Result[Bool, String]

pub struct SigningKey
pub fn SigningKey::from_seed(BytesView) -> Result[SigningKey, String]
pub fn SigningKey::public_key(SigningKey) -> Bytes
pub fn SigningKey::sign(SigningKey, BytesView) -> Bytes

pub struct VerifyingKey
pub fn VerifyingKey::from_public_key(BytesView) -> Result[VerifyingKey, String]
pub fn VerifyingKey::public_key(VerifyingKey) -> Bytes
pub fn VerifyingKey::verify(VerifyingKey, BytesView, BytesView) -> Bool
pub fn VerifyingKey::verify_result(
  VerifyingKey,
  BytesView,
  BytesView,
) -> Result[Bool, String]

#Data Model

• Private keys are 32-byte Ed25519 seeds.
• Public keys are 32 bytes.
• Signatures are 64 bytes.
• Messages are BytesView (Bytes is implicitly convertible to BytesView).

#Usage

///|
let seed : Bytes = b"\x9d\x61\xb1\x9d\xef\xfd\x5a\x60\xba\x84\x4a\xf4\x92\xec\x2c\xc4\x44\x49\xc5\x69\x7b\x32\x69\x19\x70\x3b\xac\x03\x1c\xae\x7f\x60"

///|
let message : Bytes = b"license"

///|
let public_key = @ed25519.derive_public_key(seed).unwrap()

///|
let signature = @ed25519.sign(seed, message).unwrap()

///|
let ok = @ed25519.verify(public_key, message, signature)

///|
let signing_key = @ed25519.SigningKey::from_seed(seed).unwrap()

///|
let public_key = signing_key.public_key()

///|
let signature = signing_key.sign(message)

///|
let verifying_key = @ed25519.VerifyingKey::from_public_key(public_key).unwrap()

///|
let ok = verifying_key.verify(message, signature)

#Implementation Notes

#Development

moon fmt
moon check
moon test
moon info

moon bench --release

#OpenSSL Interop Check

nu tools/openssl-interop.nu

1. Length matrix — signs and cross-verifies messages of 1, 2, 32, 64, 111, 112, 119, 120, 127, 128, 129, 200, 256, and 1024 bytes against one fresh key. Sizes 111/112/119/120/127/128/129 straddle the SHA-512 block + padding boundary; sizes ≥ 256 cover every byte value including NUL and high-bit.
2. Multi-iteration — repeats the basic round-trip with a freshly generated OpenSSL key on each iteration (default 4, controlled by --iterations N).
3. Tamper rejection — for one signed message, flips one byte in the message, the signature R, and the signature S, and asserts that both OpenSSL pkeyutl -verify and MoonBit verify reject each variant.
4. Public-key tamper rejection — flips one byte of the verifying public key at positions 0 and 31, wraps the result into a fresh SPKI DER, and asserts both sides reject the legitimate signature under the tampered pubkey (whether decode fails or the curve math fails downstream).
5. Reverse pubkey load — wraps the MoonBit-derived 32-byte public key into an Ed25519 SubjectPublicKeyInfo DER, loads it with OpenSSL, and verifies the MoonBit signature using that reconstructed PEM. Proves MoonBit pubkey bytes are independently OpenSSL-loadable.
6. External-seed injection — builds an OpenSSL DER private key from an RFC 8032 vector-1 seed, derives the public key via OpenSSL, asserts it matches the RFC vector, and asserts MoonBit produces the RFC vector-1 signature for the empty message. Anchors the seed → key → signature pipeline at known coordinates. (The empty-message signing happens through MoonBit because openssl pkeyutl -sign -rawin refuses 0-byte input.)
7. Non-prime-order public key — verifies a legitimate OpenSSL signature against the cofactor-mixed public key B + 4-torsion (5252cc0a…65ea). MoonBit rejects the key as malformed (public key is not in the prime-ordersubgroup) before signature math; OpenSSL loads the SPKI successfully and only fails at pkeyutl -verify.

#License