silk/p256

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc.

P-256 key agreement and ECDSA P-256/SHA-256 message verification.

When to use

Use P256 for the secp256r1 key agreement group. Import explicit scalar bytes with fromBytes, or acquire fresh entropy with generate. Export a key share with publicKey.

Scalars and coordinates use fixed-width big-endian encodings. Public keys use 65-byte uncompressed SEC1 form. Agreement consumes the scalar owner and returns only a complete secret. All deterministic operations use inline storage and require no allocator or host service. EcdsaP256Sha256 verifies borrowed messages, strict DER signatures and retained certificate metadata. Verification hashes messages once; it does not interpret messages as digests.

Gotchas

A shared secret does not authenticate a peer. Supply Random explicitly for generation. Entropy failure is fatal. Scalar ownership does not guarantee physical erasure of secret copies. Functional vectors and source schedules do not establish production security or constant time.

Import as P256 with import silk.p256 { P256 }.

Public declarations: 4.

`P256Error`

pub enum P256Error

A rejected scalar or peer encoding, without any secret data.

`InvalidLength`

InvalidLength = 0

The scalar is not 32 bytes or the peer point is not 65 bytes.

`InvalidScalar`

InvalidScalar = 1

The scalar is zero or is at least the group order.

`InvalidEncoding`

InvalidEncoding = 2

The peer does not use the uncompressed SEC1 prefix.

`InvalidPoint`

InvalidPoint = 3

The peer coordinates are outside the field or do not satisfy the curve equation.

`P256`

pub struct P256

One admitted private scalar, consumed by agreement and not implicitly copyable.

Associated function `P256.validatePublicKey`

pub fn validatePublicKey<'life0>(publicKey: &'life0 [u8]) -> silk/result.Result<(), silk/p256.P256Error>

Validates one strict uncompressed P-256 public point without allocation.

Details

The input must contain exactly 04 || X || Y, with 32-byte big-endian coordinates smaller than the field prime and satisfying the P-256 curve equation. This reuses the same admission routine as ECDSA verification and does not retain the input.

Associated function `P256.fromBytes`

pub fn fromBytes<'life0>(bytes: &'life0 [u8]) -> silk/result.Result<silk/p256.P256, silk/p256.P256Error>

Imports exactly 32 big-endian scalar bytes in 1 through n−1 without allocation.

Details

Wrong lengths return InvalidLength; zero and out-of-range values return InvalidScalar.

Associated function `P256.generate`

pub effect<'static> fn generate() -> P256 ? &mut Random

Acquires fresh 32-byte draws from Random until a scalar in 1 through n−1 is obtained.

Details

Rejection sampling is unbiased. Provider failure remains fatal; no fallback is selected.

Method `P256.publicKey`

pub fn publicKey<'life0>(self: &'life0 P256) -> Array<u8, 65>

Returns the 65-byte uncompressed SEC1 public key for this scalar without consuming it.

Details

The result contains prefix 0x04 and two fixed 32-byte big-endian coordinates.

Method `P256.agree`

pub fn agree<'life0>(self: P256, peer: &'life0 [u8]) -> silk/result.Result<Array<u8, 32>, silk/p256.P256Error>

Consumes this scalar and returns the peer agreement's fixed 32-byte big-endian x-coordinate.

Details

Wrong lengths, prefixes, field coordinates and off-curve points return typed errors. Failure returns no shared bytes. Compressed points and infinity are not admitted.

`P256SignatureError`

pub enum P256SignatureError

A message, signature, public key or retained algorithm that cannot be verified.

`InvalidLength`

InvalidLength = 0

The message exceeds SHA-256's supported byte length.

`InvalidKey`

InvalidKey = 1

The public key is not an admitted uncompressed P-256 point.

`InvalidEncoding`

InvalidEncoding = 2

The signature is not strict DER with r and s in 1 through n−1.

`UnsupportedAlgorithm`

UnsupportedAlgorithm = 3

The retained key or signature algorithm is unsupported.

`InvalidParameters`

InvalidParameters = 4

Curve parameters, signature parameters or unused bits are invalid.

`AuthenticationFailed`

AuthenticationFailed = 5

Admitted inputs do not satisfy the verification equation.

`EcdsaP256Sha256`

pub struct EcdsaP256Sha256

Deterministic verification of borrowed ECDSA P-256/SHA-256 messages and signatures.

Associated function `EcdsaP256Sha256.verify`

pub fn verify<'life0, 'life1, 'life2>(publicKey: &'life0 [u8], message: &'life1 [u8], signature: &'life2 [u8]) -> silk/result.Result<(), silk/p256.P256SignatureError>

Hashes the borrowed message exactly once and verifies a strict DER signature.

Details

The key must be 65-byte uncompressed SEC1. Both high-s and low-s are accepted. Message lengths above 2^61−1 bytes fail before hashing. No entropy or allocation is required.

Associated function `EcdsaP256Sha256.verifyCertificate`

pub fn verifyCertificate<'key, 'sig, 'life2, 'life3, 'life4, 'life5, 'life6>(keyAlgorithm: &'life2 silk/certificate.AlgorithmView<'key>, publicKey: &'life3 silk/certificate.BitStringView<'key>, message: &'life4 [u8], signatureAlgorithm: &'life5 silk/certificate.AlgorithmView<'sig>, signature: &'life6 silk/certificate.BitStringView<'sig>) -> silk/result.Result<(), silk/p256.P256SignatureError>

Verifies retained certificate key and signature metadata against the borrowed message.

Details

Requires id-ecPublicKey with named secp256r1, ecdsa-with-SHA256 with absent parameters, and zero unused bits. Performs no certificate extraction, trust-path or identity validation.

On this page