`std/signature`

Digital signatures, in TorbScript with no native: Ed25519 of RFC 8032, and the verification of ECDSA over P-256 with SHA-256 (FIPS 186-5), which JOSE and WebAuthn call ES256. Ed25519PrivateKey is made from a 32-byte seed and signs, Ed25519PublicKey verifies, Ed25519Signature is what passes between them; P256PublicKey verifies a P256Signature, and nothing here signs with P-256. RsaPublicKey verifies RSASSA-PKCS1-v1_5 (RS256) and RSASSA-PSS (PS256) of RFC 8017 over SHA-256 and signs nothing. SignatureError says why bytes or a text are not a key or a signature. Ed25519 is what the package registry signs its index with (docs/design/RELEASE.md section 7.4), so that a mirror can withhold a release but not change one; P-256 is what most passkeys sign with, and RSA is what GitHub Actions' OIDC tokens and many identity providers use.

A signature is not a digest (std/digest): a digest says two byte sequences are the same, a signature says who wrote them - anybody can recompute a digest, only the holder of the private key can make a signature that verifies.

Modules

std/signature/ed25519Ed25519 (RFC 8032 section 5.1): [Ed25519PrivateKey] signs, [Ed25519PublicKey] verifies, and [Ed25519Signature] is the 64 bytes between them.
std/signature/error[SignatureError]: why bytes or a text are not a key or a signature.
std/signature/p256ECDSA over P-256 with SHA-256 (FIPS 186-5 section 6.4.2, the curve of SP 800-186 section 3.2.1.3): what JOSE and WebAuthn call ES256.
std/signature/rsaRSA signature verification of RFC 8017: RSASSA-PKCS1-v1_5 (section 8.2) and RSASSA-PSS (section 8.1) with SHA-256, what JOSE calls RS256 and PS256 (RFC 7518 sections 3.3 and 3.5).

Everything

type Ed25519PrivateKeyAn Ed25519 private key: the 32-byte seed RFC 8032 calls the private key, with the secret scalar, the prefix and the public key derived from it once.
type Ed25519PublicKeyAn Ed25519 public key: 32 bytes that encode a point of the curve, checked when the key is made - a y below p, an x that exists, and the canonical sign (RFC 8032 section 5.1.3).
type Ed25519SignatureAn Ed25519 signature: 64 bytes, the encoded point R and then the scalar S, checked to be below the group order L when the signature is made (RFC 8032 section 5.1.7).
type P256PublicKeyA P-256 public key: the point Q of the curve that verifies, read from the uncompressed encoding of SEC 1 section 2.3.3 - the byte 4, then x and y as 32 bytes each, big endian - or from the two coordinates (a JSON Web Key's and a COSE key's x and y).
type P256SignatureA P-256 ECDSA signature: the two scalars r and s, each from 1 to n - 1.
type RsaPublicKeyA public RSA key: the modulus n and the public exponent e, kept as unsigned big-endian bytes without leading zeros (a JSON Web Key's n and e, RFC 7518 section 6.3.1, or a COSE key's).
type SignatureErrorWhy bytes or a text are not a key or a signature, of Ed25519, of P-256 or of RSA.
extend String with From<Ed25519PublicKey>A public key as its 64 lowercase hexadecimal digits: the way back of Ed25519PublicKey.tryFrom.
extend String with From<Ed25519Signature>A signature as its 128 lowercase hexadecimal digits: the way back of Ed25519Signature.tryFrom.
extend String with From<P256PublicKey>A public key as its 130 lowercase hexadecimal digits: the way back of P256PublicKey.tryFrom.
extend String with From<P256Signature>A signature as its 128 lowercase hexadecimal digits: the way back of P256Signature.tryFrom.