Weave Crypto
Signatures
Signature primitives in Weave Crypto — Ed25519 keypair lifecycle, deterministic signing, and verification.
Purpose
Ed25519, X25519, Merkle hashing, HKDF, random bytes, discovery keys, and namespaces.
This page follows the real source shape for Weave Crypto and explains the workflow a developer is likely to use first.
Trust contract
Document which keys authorize the operation, what is signed, what is encrypted, what is deliberately public, and which policy hook can deny the call. Security examples should use deterministic test vectors where possible.
Note
Ed25519 signing is deterministic — the same key + same message always produces the same signature. This is by design (RFC 8032) and useful for reproducible test vectors.
Primary types to know
EncryptionKeyPair— libs/weave-crypto/src/lib.rsKeyPair— libs/weave-crypto/src/lib.rsNode— libs/weave-crypto/src/lib.rsCryptoError— libs/weave-crypto/src/lib.rsNamespaceCount— libs/weave-crypto/src/lib.rs
Example shape
use weave_crypto::{key_pair, sign, verify};
fn main() {
// The module's free functions accept raw byte arrays rather than wrapping
// types. `key_pair(None)` randomises; pass Some(&seed) for determinism.
let kp = key_pair(None);
let message = b"replicate block 42";
// sign() returns a [u8; 64] Ed25519 signature.
let signature = sign(message, &kp.secret_key);
// verify() takes byte slices for the message, signature, and public key.
assert!(verify(message, &signature, &kp.public_key));
// Tampering with one byte breaks verification.
let mut tampered = message.to_vec();
tampered[0] ^= 0x01;
assert!(!verify(&tampered, &signature, &kp.public_key));
println!("signature_len={} verified=true", signature.len());
}