#hustcer/ed25519

#Module

import {
  "hustcer/ed25519@0.6.0",
}

import {
  "hustcer/ed25519",
}

#API

pub fn derive_public_key(BytesView) -> Bytes raise Ed25519Error
pub fn sign(BytesView, BytesView) -> Bytes raise Ed25519Error
pub fn verify(BytesView, BytesView, BytesView) -> Bool
pub fn verify_result(BytesView, BytesView, BytesView) -> Bool raise Ed25519Error

pub(all) suberror Ed25519Error {
  InvalidSeedLength(got~ : Int)
  InvalidPublicKeyLength(got~ : Int)
  InvalidSignatureLength(got~ : Int)
  PointYOutOfRange
  PointNotOnCurve
  PointNotCanonical
  PublicKeySmallOrder
  SignatureRSmallOrder
  PublicKeyNotPrimeOrder
  SignatureSOutOfRange
} derive(Eq, Debug)
pub impl Show for Ed25519Error

pub struct SigningKey
pub fn SigningKey::from_seed(BytesView) -> SigningKey raise Ed25519Error
pub fn SigningKey::public_key(SigningKey) -> Bytes
pub fn SigningKey::sign(SigningKey, BytesView) -> Bytes
pub fn SigningKey::verifying_key(SigningKey) -> VerifyingKey

pub struct VerifyingKey
pub fn VerifyingKey::from_public_key(BytesView) -> VerifyingKey raise Ed25519Error
pub fn VerifyingKey::public_key(VerifyingKey) -> Bytes
pub fn VerifyingKey::verify(VerifyingKey, BytesView, BytesView) -> Bool
pub fn VerifyingKey::verify_result(
  VerifyingKey,
  BytesView,
  BytesView,
) -> Bool raise Ed25519Error

#Data Model

• Private keys are 32-byte Ed25519 seeds.
• Public keys are 32 bytes.
• Signatures are 64 bytes.
• Messages are BytesView (Bytes is implicitly convertible to BytesView).

#Usage

///|
fn issue_and_check_license() -> Bool raise {
  let seed : Bytes = b"\x9d\x61\xb1\x9d\xef\xfd\x5a\x60\xba\x84\x4a\xf4\x92\xec\x2c\xc4\x44\x49\xc5\x69\x7b\x32\x69\x19\x70\x3b\xac\x03\x1c\xae\x7f\x60"
  let message : Bytes = b"license"
  let public_key = @ed25519.derive_public_key(seed)
  let signature = @ed25519.sign(seed, message)
  @ed25519.verify(public_key, message, signature)
}

///|
fn check_strict(public_key : Bytes, message : Bytes, sig : Bytes) -> Bool {
  @ed25519.verify_result(public_key, message, sig) catch {
    @ed25519.InvalidPublicKeyLength(got~) => {
      println("bad public key length: \{got}")
      false
    }
    err => {
      println("malformed input: \{err}")
      false
    }
  }
}

///|
let signing_key = @ed25519.SigningKey::from_seed(seed)

///|
let public_key = signing_key.public_key()

///|
let signature = signing_key.sign(message)

///|
let verifying_key = @ed25519.VerifyingKey::from_public_key(public_key)

///|
let ok = verifying_key.verify(message, signature)

///|
let verifying_key = signing_key.verifying_key()

#Implementation Notes

#Development

moon fmt
moon check
moon test
moon info

moon bench --release

#Wycheproof Verification Corpus

nu tools/update-wycheproof.nu --check

nu tools/update-wycheproof.nu
moon test

#OpenSSL Interop Check

nu tools/openssl-interop.nu

1. Length matrix — signs and cross-verifies messages of 1, 2, 32, 64, 111, 112, 119, 120, 127, 128, 129, 200, 256, and 1024 bytes against one fresh key. Sizes 111/112/119/120/127/128/129 straddle the SHA-512 block + padding boundary; sizes ≥ 256 cover every byte value including NUL and high-bit.
2. Multi-iteration — repeats the basic round-trip with a freshly generated OpenSSL key on each iteration (default 4, controlled by --iterations N).
3. Tamper rejection — for one signed message, flips one byte in the message, the signature R, and the signature S, and asserts that both OpenSSL pkeyutl -verify and MoonBit verify reject each variant.
4. Public-key tamper rejection — flips one byte of the verifying public key at positions 0 and 31, wraps the result into a fresh SPKI DER, and asserts both sides reject the legitimate signature under the tampered pubkey (whether decode fails or the curve math fails downstream).
5. Reverse pubkey load — wraps the MoonBit-derived 32-byte public key into an Ed25519 SubjectPublicKeyInfo DER, loads it with OpenSSL, and verifies the MoonBit signature using that reconstructed PEM. Proves MoonBit pubkey bytes are independently OpenSSL-loadable.
6. External-seed injection — builds an OpenSSL DER private key from an RFC 8032 vector-1 seed, derives the public key via OpenSSL, asserts it matches the RFC vector, and asserts MoonBit produces the RFC vector-1 signature for the empty message. Anchors the seed → key → signature pipeline at known coordinates. (The empty-message signing happens through MoonBit because openssl pkeyutl -sign -rawin refuses 0-byte input.)
7. Non-prime-order public key — verifies a legitimate OpenSSL signature against the cofactor-mixed public key B + 4-torsion (5252cc0a…65ea). MoonBit rejects the key as malformed (public key is not in the prime-ordersubgroup) before signature math; OpenSSL loads the SPKI successfully and only fails at pkeyutl -verify.

#Node.js Interop Check

fnm use 22
nu tools/node-interop.nu

• RFC 8032 vectors 1/2/3, including exact public-key and signature bytes.
• Bidirectional Node.js/MoonBit signing and verification for binary messages from 0 through 1024 bytes, including SHA-512 padding boundaries.
• A fixed application-level domain-separation mirror for context || NUL || payload; correct-context verification succeeds, while wrong-context and raw-payload variants fail on both implementations.

#License