Skip to content

stdlib.crypto

Cryptography

Generated from v0.60.1. 18 source files, 208 documented symbols.

aead.xi

fn aead_alg_supported(alg: Int) -> Bool

Whether an algorithm identifier is implemented. Complexity: O(1).

fn aead_nonce_size(alg: Int) -> Int

Nonce length in bytes for an algorithm (12 for all supported algorithms). Returns 0 for unknown algorithms. Complexity: O(1).

fn aead_tag_size(alg: Int) -> Int

Tag length in bytes for an algorithm (16 for all supported algorithms). Returns 0 for unknown algorithms. Complexity: O(1).

fn aead_key_size(alg: Int) -> Int

Key length in bytes for an algorithm: 16 (AES-128-GCM), 32 otherwise. Returns 0 for unknown algorithms. Complexity: O(1).

fn aead_generate_nonce(alg: Int) -> Vec[UInt8]

Generate a random nonce of the right size for an algorithm. Complexity: O(1).

fn aead_encrypt(alg: Int, key: &Vec[UInt8], nonce: &Vec[UInt8], data: &Vec[UInt8], aad: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

Encrypt data with associated data aad under key/nonce; returns the ciphertext with the 16-byte authentication tag appended. Complexity: O(n), n = data length.

fn aead_decrypt(alg: Int, key: &Vec[UInt8], nonce: &Vec[UInt8], data: &Vec[UInt8], aad: &Vec[UInt8], tag: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

Verify the tag and decrypt. data is the ciphertext with the 16-byte tag appended; tag is the expected tag (the trailing bytes of data). Complexity: O(n), n = data length.

fn aead_seal(alg: Int, key: &Vec[UInt8], data: &Vec[UInt8], aad: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

Encrypt with a freshly generated nonce prepended: nonce || ciphertext || tag. Complexity: O(n), n = data length.

fn aead_open(alg: Int, key: &Vec[UInt8], sealed: &Vec[UInt8], aad: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

Decrypt a sealed message (nonce || ciphertext || tag). Complexity: O(n), n = data length.

fn aead_encrypt_detached(alg: Int, key: &Vec[UInt8], nonce: &Vec[UInt8], data: &Vec[UInt8], aad: &Vec[UInt8]) -> Result[(Vec[UInt8], Vec[UInt8]), Str]

Encrypt and return the ciphertext and tag separately; the tuple is (ciphertext, tag). Complexity: O(n), n = data length.

aes.xi

fn aes_sbox(b: Int) -> Int

AES S-box substitution for one byte (0-255).

  • Precondition: b >= 0 && b <= 255
  • Postcondition: result >= 0 && result <= 255
fn aes_inv_sbox(b: Int) -> Int

Inverse AES S-box substitution for one byte (0-255).

  • Precondition: b >= 0 && b <= 255
  • Postcondition: result >= 0 && result <= 255
fn aes_rcon(round: Int) -> Int

Rijndael round constant for round (1-based).

  • Precondition: round >= 1 && round <= 10
fn aes128_encrypt(plaintext: &Vec[Int], key: &Vec[Int]) -> Result[Vec[Int], Str]

AES-128 encrypt one 16-byte block with a 16-byte key; Err on bad lengths.

  • Precondition: plaintext.len() == 16
  • Precondition: key.len() == 16
  • Postcondition: result is Ok(_) => result.len() == 16
fn aes128_decrypt(ciphertext: &Vec[Int], key: &Vec[Int]) -> Result[Vec[Int], Str]

AES-128 decrypt one 16-byte block with a 16-byte key; Err on bad lengths.

  • Precondition: ciphertext.len() == 16
  • Precondition: key.len() == 16
fn aes256_encrypt(plaintext: &Vec[Int], key: &Vec[Int]) -> Result[Vec[Int], Str]

AES-256 encrypt one 16-byte block with a 32-byte key; Err on bad lengths.

  • Precondition: plaintext.len() == 16
  • Precondition: key.len() == 32
fn aes256_decrypt(ciphertext: &Vec[Int], key: &Vec[Int]) -> Result[Vec[Int], Str]

AES-256 decrypt one 16-byte block with a 32-byte key; Err on bad lengths.

  • Precondition: ciphertext.len() == 16
  • Precondition: key.len() == 32

chacha.xi

type ChaCha20

ChaCha20 State Type

The 512-bit state is arranged as a 4x4 matrix of 32-bit words (16 words total). Layout (RFC 8439 Section 2.3): state[0..3] = constants (row 0) state[4..11] = key (rows 1,2) state[12] = block counter (row 3, col 0) state[13..15]= nonce (row 3, cols 1-3)

Field Type
state Vec[Int]

fn chacha20_new(key: &Vec[UInt8], nonce_bytes: &Vec[UInt8]) -> ChaCha20

ChaCha20 stream cipher context from a key and nonce.

fn chacha20_process(state: &ChaCha20, data: &Vec[UInt8]) -> Vec[UInt8]

Process data through the ChaCha20 state (XOR keystream). This function takes ownership of the state and consumes it. For a non-consuming version, use the module-level chacha20_encrypt/chacha20_decrypt.

fn chacha20_encrypt(key: &Vec[UInt8], nonce: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

Encrypt plaintext using ChaCha20 with the given key and nonce. key: 32 bytes (256 bits) nonce: 12 bytes (96 bits) data: plaintext to encrypt Returns: ciphertext (same length as plaintext)

fn chacha20_decrypt(key: &Vec[UInt8], nonce: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

Decrypt ciphertext using ChaCha20 with the given key and nonce. key: 32 bytes (256 bits) nonce: 12 bytes (96 bits) data: ciphertext to decrypt Returns: plaintext (same length as ciphertext) Note: This is identical to chacha20_encrypt -- ChaCha20 is a stream cipher.

cipher.xi

fn aes_block_encrypt(key: &Vec[UInt8], block: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

Raw AES block encryption (16 bytes in -> 16 bytes out, no padding/mode). Added as a public primitive so MAC modules (CBC-MAC, CMAC) can reuse the verified block cipher. Returns Err on invalid key length. Complexity: O(1) (fixed 10-14 rounds).

fn aes_block_decrypt(key: &Vec[UInt8], block: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

Raw AES block decryption (16 bytes in -> 16 bytes out). See aes_block_encrypt. Complexity: O(1).

fn aes_encrypt_ecb(key: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

AES-ECB encrypt with PKCS#7 padding. Implemented locally on the verified AES block primitive (the flat module's aes_decrypt miscompiles its length check in the current build, so delegation is unsafe). Complexity: O(n).

fn aes_decrypt_ecb(key: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

AES-ECB decrypt with padding removal. Local implementation (see aes_encrypt_ecb). Complexity: O(n).

fn aes_encrypt_cbc(key: &Vec[UInt8], iv: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

AES-CBC encrypt with PKCS#7 padding. Complexity: O(n).

fn aes_decrypt_cbc(key: &Vec[UInt8], iv: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

AES-CBC decrypt with padding removal. Complexity: O(n).

fn aes_encrypt_ctr(key: &Vec[UInt8], iv: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

AES-CTR encrypt (stream cipher, no padding; decrypt is identical). Complexity: O(n).

fn aes_decrypt_ctr(key: &Vec[UInt8], iv: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

AES-CTR decrypt (same keystream as encrypt). Complexity: O(n).

fn aes_encrypt_gcm(key: &Vec[UInt8], iv: &Vec[UInt8], data: &Vec[UInt8], aad: &Vec[UInt8]) -> Vec[UInt8]

AES-GCM encrypt (combined form: ciphertext with the 16-byte tag appended). Implemented locally (the flat module's gcm name collides here). Complexity: O(n).

fn aes_decrypt_gcm(key: &Vec[UInt8], iv: &Vec[UInt8], data: &Vec[UInt8], aad: &Vec[UInt8], tag: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

AES-GCM decrypt and verify the tag. The ciphertext data carries the 16-byte tag appended (see aes_encrypt_gcm). Complexity: O(n).

fn aes_encrypt_cfb(key: &Vec[UInt8], iv: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

AES-CFB128 encrypt (stream, no padding). Complexity: O(n).

fn aes_encrypt_ofb(key: &Vec[UInt8], iv: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

AES-OFB encrypt (stream, no padding; decrypt is identical). Complexity: O(n).

fn aes_generate_key() -> Vec[UInt8]

Generate a random 256-bit AES key from the system CSPRNG. Complexity: O(1).

fn aes_key_from_passphrase(passphrase: &Vec[UInt8], salt: &Vec[UInt8], iterations: Int) -> Vec[UInt8]

Derive a 32-byte AES key from a passphrase using PBKDF2-HMAC-SHA256. Complexity: O(iterations).

fn chacha20_encrypt(key: &Vec[UInt8], nonce: &Vec[UInt8], counter: Int, data: &Vec[UInt8]) -> Vec[UInt8]

ChaCha20 stream encrypt with an explicit 32-bit block counter. Built on xiom.chacha (the counter is seeded into the public ChaCha20 state). Complexity: O(n).

fn chacha20_decrypt(key: &Vec[UInt8], nonce: &Vec[UInt8], counter: Int, data: &Vec[UInt8]) -> Vec[UInt8]

ChaCha20 stream decrypt (identical to encrypt). Complexity: O(n).

fn chacha20poly1305_encrypt(key: &Vec[UInt8], nonce: &Vec[UInt8], data: &Vec[UInt8], aad: &Vec[UInt8]) -> Vec[UInt8]

ChaCha20-Poly1305 AEAD encrypt (RFC 8439): returns ciphertext with the 16-byte tag appended. Complexity: O(n).

fn chacha20poly1305_decrypt(key: &Vec[UInt8], nonce: &Vec[UInt8], data: &Vec[UInt8], aad: &Vec[UInt8], tag: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

ChaCha20-Poly1305 AEAD decrypt and verify the tag. Complexity: O(n).

fn des_encrypt(key: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

Legacy single-DES encrypt (ECB, 8-byte blocks, PKCS#7 padding). Delegates to xiom.des. Interop only. Complexity: O(n).

fn des_decrypt(key: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

Legacy single-DES decrypt (ECB, padding removal). Interop only. Complexity: O(n).

fn triple_des_encrypt(key: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

3DES-EDE encrypt (3 x 8-byte keys, PKCS#7 padding). Delegates to xiom.des. Interop only. Complexity: O(n).

fn triple_des_decrypt(key: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

3DES-EDE decrypt (padding removal). Interop only. Complexity: O(n).

crypto.xi

fn sha256(data: &Vec[UInt8]) -> Vec[UInt8]

SHA-256 digest (32 bytes).

fn sha256_accelerated(data: &Vec[UInt8]) -> Vec[UInt8]

SHA-256 using the hardware-accelerated path when available.

  • Precondition: data.len() > 0
  • Postcondition: result.len() == 32

fn sha256_hex(data: &Vec[UInt8]) -> Str

Lowercase hex SHA-256 digest.

fn sha512(data: &Vec[UInt8]) -> Vec[UInt8]

SHA-512 digest (64 bytes).

  • Postcondition: result.len() == 64

fn md5(data: &Vec[UInt8]) -> Vec[UInt8]

MD5 digest (legacy; not for security use).

  • Postcondition: result.len() == 16

fn md5_bytes(data: &Vec[UInt8]) -> Vec[UInt8]

Alias for md5 whose name cannot collide with the legacy xiom.crypto.md5 module in dotted call position (strict import gate).

  • Postcondition: result.len() == 16

fn blake3(data: &Vec[UInt8]) -> Vec[UInt8]

Compute the BLAKE3 hash of data (32-byte output).

Spec: https://github.com/BLAKE3-team/BLAKE3-specs

Single-chunk inputs (<= 1024 bytes) compress the chunk directly with CHUNK_START|CHUNK_END|ROOT. Larger inputs are hashed through the binary tree: each 1024-byte chunk produces a leaf CV (chunk counter = chunk index), leaves are merged pairwise via parent nodes, and the root node carries the ROOT flag. The 32-byte digest is the root output words 7,6,5,4,3,2,1,0 serialized little-endian (reversed word order).

fn hmac_sha256(key: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

HMAC-SHA-256 of data with key.

  • Postcondition: result.len() == 32

fn aes_encrypt(key: &Vec[UInt8], plaintext: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

AES encrypt with the given key; Err on bad key/data lengths.

fn aes_decrypt(key: &Vec[UInt8], ciphertext: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

AES decrypt with the given key; Err on bad key/data or padding.

fn aes_encrypt_gcm(key: &Vec[UInt8], nonce: &Vec[UInt8], plaintext: &Vec[UInt8], aad: &Vec[UInt8]) -> Result[(Vec[UInt8], Vec[UInt8]), Str]

AES-GCM encrypt: Ok((ciphertext, tag)); Err on bad lengths.

fn aes_decrypt_gcm(key: &Vec[UInt8], nonce: &Vec[UInt8], ciphertext: &Vec[UInt8], tag: &Vec[UInt8], aad: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

AES-GCM decrypt and verify the tag; Err on failure.

type KeyPair

Asymmetric (RSA)

Field Type
public Vec[UInt8]
private Vec[UInt8]

fn generate_rsa_keypair(bits: Int) -> Result[KeyPair, Str]

Generate an RSA key pair of bits bits; Err on failure.

fn rsa_encrypt(public_key: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

RSA encrypt with a public key; Err on failure.

fn rsa_decrypt(private_key: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

RSA decrypt with a private key; Err on failure.

fn rsa_sign(private_key: &Vec[UInt8], data: &Vec[UInt8]) -> Result[Vec[UInt8], Str]

RSA signature over data; Err on failure.

fn rsa_verify(public_key: &Vec[UInt8], data: &Vec[UInt8], signature: &Vec[UInt8]) -> Result[Bool, Str]

Verify an RSA signature; Ok(true/false) or Err.

fn pbkdf2(password: &Str, salt: &Vec[UInt8], iterations: Int, key_len: Int) -> Vec[UInt8]

Key Derivation

  • Precondition: iterations > 0
  • Precondition: key_len > 0
  • Postcondition: result.len() == key_len

fn argon2(password: &Str, salt: &Vec[UInt8], memory: Int, iterations: Int, parallelism: Int) -> Vec[UInt8]

Argon2 key derivation with the given memory/iteration/parallelism costs.

fn os_secure_random_bytes(count: Int) -> Vec[UInt8]

OS-entropy CSPRNG draw (ProcessPrng/RtlGenRandom on Windows, /dev/urandom on Unix), degrading to the legacy PRNG only when no OS source answers (degraded mode documented -- do not treat as secure). Backs secure_random_bytes since the confined-block growth fix (COMPILER_BUGS.md R4, 041e8bb3) removed the multi-draw AV; also used for the legacy fallback's one-time process seed.

fn secure_random_bytes(count: Int) -> Vec[UInt8]

OS-entropy random bytes (the CSPRNG source for the crypto modules).

fn constant_time_compare(a: &Vec[UInt8], b: &Vec[UInt8]) -> Bool

True when the byte strings are equal, in constant time.

  • Postcondition: result == true => a.len() == b.len()

fn hkdf_sha256(ikm: &Vec[UInt8], salt: &Vec[UInt8], info: &Vec[UInt8], okm_len: Int) -> Result[Vec[UInt8], Str]

HKDF (RFC 5869) -- HMAC-based Key Derivation Function

HKDF consists of two steps: 1. Extract: PRK = HMAC-SHA256(salt, IKM) 2. Expand: OKM = T(1) || T(2) || ... || T(N) truncated to okm_len where T(0) = empty, T(i) = HMAC-SHA256(PRK, T(i-1) || info || i) i is a single byte counter (1, 2, 3, ...)

RFC 5869 test case 1: IKM = 0x0b0b0b... (22 times) salt = 0x000102030405060708090a0b0c info = 0xf0f1f2f3f4f5f6f7f8f9 L = 42 OKM = 3cb25f25faacd57a90434f64d0362f2a 2d2d0a90cf1a5a4c5db02d56ecc4c5bf 34007208d5b887185865

Security notes: - Extract step concentrates entropy from IKM. - Salt should be random but not secret; can be all-zeros. - Info binds derived key to context; must be unique per key.

fn chacha20_poly1305_encrypt(key: &Vec[UInt8], nonce: &Vec[UInt8], aad: &Vec[UInt8], plaintext: &Vec[UInt8], ciphertext: &mut Vec[UInt8], tag: &mut Vec[UInt8]) -> Bool

ChaCha20-Poly1305 AEAD (RFC 8439 Section 2.8)

Authenticated Encryption with Associated Data using ChaCha20 and Poly1305.

Algorithm: 1. Generate 32-byte Poly1305 one-time key from ChaCha20 block 0 keystream. 2. Encrypt plaintext using ChaCha20 keystream starting from block 1. 3. Compute Poly1305 tag over: pad16(AAD) || pad16(ciphertext) || le64(AAD_len) || le64(CT_len).

Key: 32 bytes (256-bit). Nonce: 12 bytes (96-bit), MUST be unique per key. AAD: arbitrary bytes, authenticated but NOT encrypted. Plaintext: arbitrary bytes to encrypt and authenticate. ciphertext: out-param, populated with encrypted data (same length as plaintext). tag: out-param, populated with 16-byte authentication tag. Returns: true on success.

RFC 8439 test vector (Section 2.8.2): key = 808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f nonce = 070000004041424344454647 aad = 50515253c0c1c2c3c4c5c6c7 plaintext = "Ladies and Gentlemen of the class of '99..." ciphertext = d31a8d34648e60db7b86afbc53ef7ec2... tag = 1ae10b594f09e26a7e902ecbd0600691

Security notes: - Nonce MUST be unique for every message under the same key. - Nonce reuse completely breaks confidentiality AND authenticity. - The 16-byte tag provides 128-bit authentication strength.

fn chacha20_poly1305_decrypt(key: &Vec[UInt8], nonce: &Vec[UInt8], aad: &Vec[UInt8], ciphertext: &Vec[UInt8], tag: &Vec[UInt8], plaintext: &mut Vec[UInt8]) -> Bool

ChaCha20-Poly1305 AEAD -- Decrypt

Algorithm: 1. Re-generate Poly1305 one-time key from ChaCha20 block 0. 2. Compute expected tag over: pad16(AAD) || pad16(ciphertext) || le64(AAD_len) || le64(CT_len). 3. Compare expected_tag with provided tag in constant time. 4. If match, decrypt ciphertext to plaintext using ChaCha20 block 1+ keystream.

Key: 32 bytes. Nonce: 12 bytes. AAD: authenticated but unencrypted data. ciphertext: encrypted data to authenticate and decrypt. tag: 16-byte authentication tag to verify. plaintext: out-param, populated with decrypted data on success. Returns: true if authentication passed and decryption succeeded.

Security notes: - Decryption only proceeds if tag verification passes (encrypt-then-MAC). - Constant-time tag comparison prevents timing oracle attacks.

fn sha224(data: &Vec[UInt8]) -> Vec[UInt8]

SHA-224 delegates to the runtime C path (xiom_sha224_hash in runtime/sha256_sw.c). The previous XIOM-side state marshalling around xiom_sha256_sw_compress miscompiles (zero-offset store corruption into the malloc'd state buffer; probed 2026-08-24 -- wrong digests for any non-empty message while empty passed). Same architecture as sha256 below.

  • Postcondition: result.len() == 28

fn sha384(data: &Vec[UInt8]) -> Vec[UInt8]

SHA-384 digest (48 bytes).

  • Postcondition: result.len() == 48

curves.xi

fn curve25519_clamp(scalar: &Vec[UInt8]) -> Vec[UInt8]

Apply the X25519 clamping rules to a 32-byte scalar. Complexity: O(1).

fn curve25519_base_point() -> Vec[UInt8]

The standard Curve25519 base point encoding: u = 9. Complexity: O(1).

fn curve25519_scalar_mult(scalar: &Vec[UInt8], point: &Vec[UInt8]) -> Vec[UInt8]

Scalar multiplication of a point on Curve25519 (X25519 ladder). scalar and point are 32-byte little-endian encodings; returns the X coordinate little-endian. The caller should clamp the scalar first. Complexity: O(255) field multiplications.

fn secp256k1_generator() -> (Vec[UInt8], Vec[UInt8])

secp256k1 generator point; the tuple is (x, y). Complexity: O(1).

fn secp256k1_point_add(a: &Vec[UInt8], b: &Vec[UInt8]) -> (Vec[UInt8], Vec[UInt8])

secp256k1 point addition; the tuple is (x, y). Returns the point at infinity as (0, 0). Complexity: O(1) field operations.

fn secp256k1_point_mul(scalar: &Vec[UInt8], point: &Vec[UInt8]) -> (Vec[UInt8], Vec[UInt8])

secp256k1 scalar multiplication (double-and-add); the tuple is (x, y). Complexity: O(256) point operations.

fn p256_curve_order() -> Vec[UInt8]

The P-256 group order n. Complexity: O(1).

fn curve_order(curve: Int) -> Vec[UInt8]

Group order for a named curve: 1 = secp256k1, 2 = P-256, 4 = Ed25519. Returns an empty vector for Curve25519 (no standard group order). Complexity: O(1).

fn curve_point_on_curve(curve: Int, x: &Vec[UInt8], y: &Vec[UInt8]) -> Bool

Test whether (x, y) satisfies the curve equation for a named curve (1 = secp256k1, 2 = P-256). Complexity: O(1) field operations.

fn curve_scalar_valid(curve: Int, scalar: &Vec[UInt8]) -> Bool

Test whether a scalar is a valid private key for a named curve (1 = secp256k1, 2 = P-256, 3 = Curve25519): 1 <= scalar < n. Complexity: O(1).

des.xi

fn des_encrypt_block(block: Int, key: Int) -> Int

Encrypt a single 64-bit block with DES (FIPS 46-3).

fn des_decrypt_block(block: Int, key: Int) -> Int

Decrypt a single 64-bit block with DES (FIPS 46-3).

fn des3_encrypt_block(block: Int, k1: Int, k2: Int, k3: Int) -> Int

Encrypt a 64-bit block with Triple-DES EDE: C = E_K3(D_K2(E_K1(P))). When K1 == K2 == K3 this degenerates to single DES.

fn des3_decrypt_block(block: Int, k1: Int, k2: Int, k3: Int) -> Int

Decrypt a 64-bit block with Triple-DES EDE: P = D_K1(E_K2(D_K3(C))).

ecc.xi

type EcPoint

Affine point on an elliptic curve y2 = x3 + ax + b (mod p).

Field Type
x Int
y Int

type EcPointOpt

Optional EcPoint: replaces Option[EcPoint] due to compiler limitations. pt field is valid only when is_some == true.

Field Type
is_some Bool
pt EcPoint

type EcCurve

Elliptic curve parameters for short Weierstrass form.

Field Type
p Int
a Int
b Int
n Int
gx Int
gy Int

type Ed25519KeyPair

Ed25519 key pair.

Field Type
public_key Vec[UInt8]
private_key Vec[UInt8]

type Ed25519Signature

Ed25519 signature.

Field Type
r Vec[UInt8]
s Vec[UInt8]

fn curve_small_test() -> EcCurve

Small Test Curve: y2 = x3 + 2x + 2 mod 17

Order 19 (prime). Generator: (5, 1).

fn curve_secp256k1() -> EcCurve

The secp256k1 curve parameters.

fn ec_is_on_curve(point: &EcPoint, curve: &EcCurve) -> Bool

Point Operations

fn ec_neg(point: EcPointOpt, curve: &EcCurve) -> EcPointOpt

Negate a point (None for the point at infinity).

fn ec_double(point: &EcPoint, curve: &EcCurve) -> EcPointOpt

Point doubling; None for the point at infinity.

fn ec_add(p: EcPointOpt, q: EcPointOpt, curve: &EcCurve) -> EcPointOpt

Point addition; None when the result is the point at infinity.

fn ec_mul(k: Int, point: &EcPoint, curve: &EcCurve) -> EcPointOpt

Scalar multiplication k * point; None for the point at infinity.

fn ed25519_keygen() -> Ed25519KeyPair

Generate an Ed25519 key pair.

fn ed25519_sign(message: &Vec[Int], keypair: &Ed25519KeyPair) -> Ed25519Signature

Ed25519 signature over the message.

fn ed25519_verify(message: &Vec[Int], signature: &Ed25519Signature, public_key: &Vec[UInt8]) -> Bool

True when the signature verifies under the public key.

fn secp256k1_point_valid_bytes(px: &Vec[UInt8], py: &Vec[UInt8]) -> Bool

Check if an affine point (px, py) lies on the secp256k1 curve. px, py: 32-byte little-endian buffers.

  • Precondition: px.len() >= 32
  • Precondition: py.len() >= 32

fn secp256k1_point_mul_bytes(k: &Vec[UInt8], px: &Vec[UInt8], py: &Vec[UInt8], out_x: &mut Vec[UInt8], out_y: &mut Vec[UInt8]) -> Bool

Scalar multiply point (px, py) by scalar k. Fills out_x, out_y with 32-byte little-endian results. Returns false on error (invalid inputs).

  • Precondition: k.len() >= 32
  • Precondition: px.len() >= 32
  • Precondition: py.len() >= 32

fn secp256k1_base_mul_bytes(k: &Vec[UInt8], out_x: &mut Vec[UInt8], out_y: &mut Vec[UInt8]) -> Bool

Multiply the secp256k1 base point (generator G) by scalar k. Fills out_x, out_y with 32-byte little-endian results.

  • Precondition: k.len() >= 32

fn ed25519_pubkey_bytes(private_key: &Vec[UInt8], public_key: &mut Vec[UInt8]) -> Bool

Derive a 32-byte Ed25519 public key from a 32-byte private key.

  • Precondition: private_key.len() >= 32

fn ed25519_sign_bytes(message: &Vec[UInt8], private_key: &Vec[UInt8], signature: &mut Vec[UInt8]) -> Bool

Sign a message with an Ed25519 private key (32 bytes). Writes the 64-byte signature into signature.

  • Precondition: private_key.len() >= 32

fn ed25519_verify_bytes(message: &Vec[UInt8], public_key: &Vec[UInt8], signature: &Vec[UInt8]) -> Bool

Verify an Ed25519 signature (64 bytes) against a message and public key (32 bytes).

  • Precondition: public_key.len() >= 32
  • Precondition: signature.len() >= 64

hash.xi

fn crypto_hash_sha1(data: &Vec[UInt8]) -> Vec[UInt8]

SHA-1 (FIPS 180-1). 20-byte digest. Legacy, interop only.

  • Postcondition: result.len() == 20
fn crypto_hash_blake2b(data: &Vec[UInt8]) -> Vec[UInt8]

BLAKE2b-512 digest (64 bytes).

  • Postcondition: result.len() == 64
fn crypto_hash_sha256(data: &Vec[UInt8]) -> Vec[UInt8]

SHA-256 digest (32 bytes). Delegates to xiom.crypto.sha256. Complexity: O(n), n = input length.

fn crypto_hash_sha512(data: &Vec[UInt8]) -> Vec[UInt8]

SHA-512 digest (64 bytes). Implemented locally with the corrected 64-bit rotate; the flat module's sha512 is not used (broken in the current build). Complexity: O(n), n = input length.

fn crypto_hash_md5(data: &Vec[UInt8]) -> Vec[UInt8]

MD5 digest (16 bytes). Local implementation (the flat module's md5 fails its test vector in the current build). Legacy, interop only. Complexity: O(n), n = input length.

fn crypto_hash_sha256_hex(data: &Vec[UInt8]) -> Str

SHA-256 digest as lowercase hex. Delegates to xiom.crypto.sha256_hex. Complexity: O(n), n = input length.

fn crypto_hash_sha512_hex(data: &Vec[UInt8]) -> Str

SHA-512 digest as lowercase hex (128 characters). Complexity: O(n), n = input length.

fn crypto_hash_hmac_sha256(key: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

Keyed SHA-256 MAC. Delegates to xiom.crypto.hmac_sha256. Complexity: O(n), n = input length.

fn crypto_hash_hmac_sha512(key: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

Keyed SHA-512 MAC (RFC 2104), built on the local SHA-512. Complexity: O(n), n = input length.

fn crypto_hash_hmac_md5(key: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

Keyed MD5 MAC (RFC 2104). Legacy, interop only. Complexity: O(n), n = input length.

fn crypto_hash_pbkdf2_sha256(password: &Vec[UInt8], salt: &Vec[UInt8], iterations: Int, len: Int) -> Vec[UInt8]

PBKDF2-HMAC-SHA256 (RFC 2898): derive len key bytes from a password. Complexity: O(iterations * len / 32).

fn crypto_hash_hkdf(ikm: &Vec[UInt8], salt: &Vec[UInt8], info: &Vec[UInt8], len: Int) -> Vec[UInt8]

HKDF (RFC 5869) with SHA-256. salt may be empty (defaults to zeros). Complexity: O(len / 32 + n).

kdf.xi

fn pbkdf2(password: &Vec[UInt8], salt: &Vec[UInt8], iterations: Int, key_len: Int) -> Vec[UInt8]

Generic PBKDF2 key derivation (HMAC-SHA256 based). iterations and key_len must be positive; invalid inputs yield an empty vector. Complexity: O(iterations * key_len / 32).

fn pbkdf2_hmac_sha256(password: &Vec[UInt8], salt: &Vec[UInt8], iterations: Int, key_len: Int) -> Vec[UInt8]

PBKDF2 with HMAC-SHA256 (alias of pbkdf2). Complexity: O(iterations * key_len / 32).

fn hkdf_extract(hash: Int, ikm: &Vec[UInt8], salt: &Vec[UInt8]) -> Vec[UInt8]

HKDF extract step: PRK = HMAC(salt, IKM). hash selects SHA-256 (1) or SHA-512 (2). Complexity: O(n), n = IKM length.

fn hkdf_expand(hash: Int, prk: &Vec[UInt8], info: &Vec[UInt8], len: Int) -> Vec[UInt8]

HKDF expand step: produce len bytes from the pseudorandom key prk. hash selects SHA-256 (1) or SHA-512 (2). Returns an empty vector for len out of range. Complexity: O(len / hash_len).

fn hkdf_sha256(ikm: &Vec[UInt8], salt: &Vec[UInt8], info: &Vec[UInt8], len: Int) -> Vec[UInt8]

One-shot HKDF-SHA256: extract then expand. Complexity: O(len / 32 + n).

fn kdf_derive_master(secret: &Vec[UInt8], salt: &Vec[UInt8], info: &Vec[UInt8], len: Int) -> Vec[UInt8]

Derive a master key from a shared secret (HKDF-SHA256 with the shared secret as IKM and an empty salt). Complexity: O(len / 32 + n).

fn kdf_check_interval(n: Int) -> Int

Validate and adjust a cost parameter: clamps to [1, 1_000_000]. Complexity: O(1).

fn scrypt(password: &Vec[UInt8], salt: &Vec[UInt8], n: Int, r: Int, p: Int, key_len: Int) -> Vec[UInt8]

Memory-hard scrypt key derivation (RFC 7914). Uses PBKDF2-HMAC-SHA256 for the outer/inner hashes and Salsa20/8 for the block mix. n must be a power of two; it is clamped to 2^18 and r*p to 256. Complexity: O(n * r * p).

fn argon2id(password: &Vec[UInt8], salt: &Vec[UInt8], memory: Int, iterations: Int, parallelism: Int, key_len: Int) -> Vec[UInt8]

Argon2id-style key derivation. This is a DOCUMENTED APPROXIMATION: it derives via PBKDF2-HMAC-SHA256 with the memory budget folded into the iteration count (matching the pattern of the flat argon2 helper). A full RFC 9106 implementation (BLAKE2b blocks + memory-hard passes) is not practical in pure XIOM. Do not use where exact Argon2id compatibility is required. Complexity: O(iterations * memory / 1024 + iterations).

fn bcrypt(password: &Vec[UInt8], salt: &Vec[UInt8], cost: Int) -> Vec[UInt8]

bcrypt-style password hashing. This is a DOCUMENTED APPROXIMATION: PBKDF2-HMAC-SHA256 with 2^cost iterations and a version marker derived from the salt's first byte. A full Blowfish-EksBlowfish implementation is not practical in pure XIOM. Do not use where exact bcrypt compatibility is required. Complexity: O(2^cost).

keyx.xi

fn x25519_keypair() -> (Vec[UInt8], Vec[UInt8])

Generate a new X25519 keypair; the tuple is (sk, pk). NOTE: Vec-tuple returns miscompile in the current build; prefer x25519_public_key on a random secret. Complexity: O(255) field operations.

fn x25519_public_key(sk: &Vec[UInt8]) -> Vec[UInt8]

Derive the X25519 public key from a secret key. Complexity: O(255) field operations.

fn x25519_shared_secret(sk: &Vec[UInt8], pk: &Vec[UInt8]) -> Vec[UInt8]

Compute the X25519 shared secret between a secret key and a peer public key. Complexity: O(255) field operations.

fn x25519_base(sk: &Vec[UInt8]) -> Vec[UInt8]

Multiply the base point by sk (public key). Alias of x25519_public_key. Complexity: O(255) field operations.

fn ecdh_p256(sk: &Vec[UInt8], pk: &Vec[UInt8]) -> Vec[UInt8]

ECDH shared secret on P-256 (x coordinate of sk * pk). Requires a P-256 point-multiplication primitive; delegates to the secp256k1 ladder is NOT possible, so this returns an empty vector until a P-256 point multiplier is wired in (see report). Complexity: O(256) point operations.

fn ecdh_secp256k1(sk: &Vec[UInt8], pk: &Vec[UInt8]) -> Vec[UInt8]

ECDH shared secret on secp256k1 (x coordinate of sk * pk). Complexity: O(256) point operations.

fn dh_generate_key(prime: &Vec[UInt8], generator: &Vec[UInt8]) -> Vec[UInt8]

Generate a classic DH private key in [2, p-2]. Complexity: O(1) expected.

fn dh_shared_secret(prime: &Vec[UInt8], own_sk: &Vec[UInt8], peer_pk: &Vec[UInt8]) -> Vec[UInt8]

Compute the classic DH shared secret: peer_pk ^ own_sk mod prime. Complexity: O(bitlen^3).

fn key_agreement_derive(shared: &Vec[UInt8], info: &Vec[UInt8], len: Int) -> Vec[UInt8]

Derive symmetric key bytes from a shared secret (HKDF-SHA256). Complexity: O(len / 32 + n).

fn key_agreement_validate(pk: &Vec[UInt8]) -> Bool

Sanity-check a peer public key: 32 bytes and not all zero. Complexity: O(1).

mac.xi

type Hmac

HMAC context (keyed hash state).

Field Type
key Vec[UInt8]
hash Int
block Int
data Vec[UInt8]
fn hmac_new(key: &Vec[UInt8], hash: Int) -> Hmac

Create an incremental HMAC. hash selects the digest (1=SHA-256, 2=SHA-512, 3=MD5); unknown values fall back to SHA-256. Complexity: O(key length).

fn hmac_update(h: &mut Hmac, data: &Vec[UInt8])

Feed data into an in-progress HMAC. Complexity: O(n), n = data length.

fn hmac_final(h: Hmac) -> Vec[UInt8]

Finish an HMAC and return the tag. Complexity: O(n), n = accumulated data length.

fn hmac_sha256(key: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

One-shot HMAC-SHA256 (RFC 2104). Implemented locally on xiom.crypto.sha256; matches the flat hmac_sha256 and RFC 4231 vectors. Complexity: O(n), n = data length.

fn hmac_sha512(key: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

One-shot HMAC-SHA512 (RFC 2104). Uses xiom.crypto.sha512 (verified). Complexity: O(n), n = data length.

fn hmac_verify(key: &Vec[UInt8], data: &Vec[UInt8], tag: &Vec[UInt8]) -> Bool

Verify an HMAC-SHA256 tag in constant time. Complexity: O(n), n = data length.

fn poly1305_mac(key: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

Poly1305 one-shot MAC (16 bytes). Delegates to xiom.poly1305.poly1305_mac. Complexity: O(n), n = message length.

fn poly1305_verify(key: &Vec[UInt8], data: &Vec[UInt8], tag: &Vec[UInt8]) -> Bool

Constant-time Poly1305 verification. Complexity: O(n), n = message length.

fn cbc_mac(key: &Vec[UInt8], iv: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

CBC-MAC over the message (NIST SP 800-38B style: full 16-byte blocks; the final partial block is zero-padded). Uses the AES block primitive. Complexity: O(n), n = data length.

fn cmac_aes128(key: &Vec[UInt8], data: &Vec[UInt8]) -> Vec[UInt8]

AES-CMAC-128 (NIST SP 800-38B). Uses the AES block primitive. Complexity: O(n), n = data length.

fn constant_time_eq(a: &Vec[UInt8], b: &Vec[UInt8]) -> Bool

Timing-safe byte comparison (arithmetic accumulation, no early exit). Complexity: O(n), n = byte length.

fn constant_time_select(a: Int, b: Int, bit: Bool) -> Int

Constant-time select: returns a when bit is true, else b. Both branches are evaluated and combined arithmetically. Complexity: O(1).

md5.xi

fn md5(data: &Vec[Int]) -> Vec[Int]

MD5 digest of the byte values (legacy hash; not for security use).

  • Precondition: data.len() > 0
  • Postcondition: result.len() == 16
fn md5_hex(data: &Vec[Int]) -> Str

Lowercase hex MD5 digest (legacy hash; not for security use).

  • Precondition: data.len() > 0
  • Postcondition: result.len() == 32

poly1305.xi

fn poly1305_mac(key: &Vec[UInt8], msg: &Vec[UInt8]) -> Vec[UInt8]

Poly1305 MAC -- Main Function

Computes a 16-byte authenticator tag for the given message under the given 32-byte one-time key.

Algorithm: 1. Split key: r = key[0..15] (clamped), s = key[16..31] 2. Initialize accumulator h = 0 (all 5 limbs = 0) 3. Process each 16-byte message block: a. Convert block + 0x01 to 5 limbs (n) b. h = h + n (limb-wise) c. h = h * r mod p 4. Finalize: tag = low 128 bits of (h + s)

Parameters: key: 32-byte one-time key (Vec[Int] where each element is a byte value 0-255, or Vec[UInt8]) msg: message to authenticate Returns: 16-byte tag as Vec[Int] (each element 0-255)

IMPORTANT: The key MUST be used only once per key. Key reuse breaks security. Use with ChaCha20 as ChaCha20-Poly1305 AEAD for authenticated encryption.

rng_crypto.xi

fn crypto_random_bytes(len: Int) -> Vec[UInt8]

Fill len bytes from the CSPRNG. Negative lengths return an empty vector. Complexity: O(len).

fn crypto_random_u64() -> UInt64

Random 64-bit unsigned integer. Complexity: O(1).

fn crypto_random_u32() -> UInt32

Random 32-bit unsigned integer. Complexity: O(1).

fn crypto_random_uniform(n: Int) -> Int

Unbiased random integer in [0, n). Returns 0 for n <= 0. Complexity: O(1) expected.

fn crypto_random_float() -> Float64

Random double in [0, 1). Uses the top 53 bits of a 64-bit draw. Complexity: O(1).

fn crypto_random_bool() -> Bool

Fair random boolean. Complexity: O(1).

fn crypto_random_shuffle[T](v: &mut Vec[T])

Fisher-Yates shuffle in place using the CSPRNG. Complexity: O(n), n = vector length.

fn crypto_random_choice[T](v: &Vec[T]) -> Option[T]

Pick a uniformly random element, or None for an empty vector. Complexity: O(1).

fn crypto_seed_from_entropy() -> UInt64

Seed value gathered from system entropy (8 bytes). Complexity: O(1).

fn crypto_random_prime(bits: Int) -> Vec[UInt8]

Generate a probable prime of the given bit length (big-endian bytes). Uses bigint_is_prime (probabilistic). Returns an empty vector on invalid bit lengths or failure. Complexity: expected O(bits^4) with rejection.

fn crypto_random_string(len: Int, alphabet: Str) -> Str

Random string drawn from an alphabet (uniform via the CSPRNG). Returns an empty string when the alphabet is empty or len is negative. Complexity: O(len).

rsa.xi

type RsaKeyPair

Full RSA key pair (private key). n: modulus (p * q) e: public exponent d: private exponent (e-1 mod phi(n))

Field Type
n Int
e Int
d Int

type RsaPublicKey

RSA public key. n: modulus e: public exponent

Field Type
n Int
e Int

fn rsa_public_key(pair: &RsaKeyPair) -> RsaPublicKey

Derive the public key (n, e) from a key pair. The public key can be safely shared; the private exponent d stays inside the RsaKeyPair.

fn rsa_keygen(bits: Int) -> Result[RsaKeyPair, Str]

Generate an RSA key pair with approximately bits bits of modulus.

Algorithm: 1. Choose two distinct primes p, q of roughly bits/2 each. 2. n = p * q (must fit in i64: n < 2^63) 3. phi = (p-1) * (q-1) 4. e = 65537 (standard RSA public exponent; Fermat prime F4) If 65537 >= phi or gcd(e, phi) != 1, fall back to e = 3 and search. 5. d = e-1 mod phi (modular inverse via extended Euclidean algorithm)

Parameters: bits: desired modulus size in bits (recommended: 16-30 for this impl) Returns: Result[RsaKeyPair, Str] -- the key pair or an error message

Complexity: O(2^(bits/2)) for primality testing due to trial division. Keep bits <= 30 for reasonable performance.

fn rsa_encrypt(msg: Int, key: &RsaPublicKey) -> Int

Encrypt a message using RSA.

c == m^e mod n

Parameters: msg: plaintext message (Int, must be < n) key: RSA public key (n, e) Returns: ciphertext (Int)

Note: In real RSA, messages are padded and encoded as integers < n. This raw implementation encrypts a single integer value.

fn rsa_decrypt(ct: Int, key: &RsaKeyPair) -> Int

Decrypt a ciphertext using RSA.

m == c^d mod n

Parameters: ct: ciphertext (Int, must be < n) key: RSA key pair (n, e, d) Returns: plaintext (Int)

fn rsa_sign(msg: Int, key: &RsaKeyPair) -> Int

Sign a message using RSA (textbook/Raw RSA signature).

sig == m^d mod n

Parameters: msg: message to sign (Int) key: RSA key pair (n, e, d) Returns: signature (Int)

Security note: Real RSA signing uses PSS padding and hashes the message before signing. This raw version is for education only.

fn rsa_verify(msg: Int, sig: Int, key: &RsaPublicKey) -> Bool

Verify an RSA signature.

m' == sig^e mod n; returns (m' == msg)

Parameters: msg: original message (Int) sig: signature to verify (Int) key: RSA public key (n, e) Returns: true if signature is valid

sha.xi

fn sha256_initial_h0() -> Int

SHA-256 initial hash value H0 (FIPS 180-4).

fn sha256_initial_h1() -> Int

SHA-256 initial hash value H1 (FIPS 180-4).

fn sha256_initial_h2() -> Int

SHA-256 initial hash value H2 (FIPS 180-4).

fn sha256_initial_h3() -> Int

SHA-256 initial hash value H3 (FIPS 180-4).

fn sha256_initial_h4() -> Int

SHA-256 initial hash value H4 (FIPS 180-4).

fn sha256_initial_h5() -> Int

SHA-256 initial hash value H5 (FIPS 180-4).

fn sha256_initial_h6() -> Int

SHA-256 initial hash value H6 (FIPS 180-4).

fn sha256_initial_h7() -> Int

SHA-256 initial hash value H7 (FIPS 180-4).

fn sha256_k(index: Int) -> Int

SHA-256 round constant K[index] (0..63).

fn sha256(data: &Vec[Int]) -> Vec[Int]

SHA-256 digest of the byte values (32 bytes).

  • Postcondition: result.len() == 32
fn sha256_hex(data: &Vec[Int]) -> Str

Lowercase hex SHA-256 digest.

  • Precondition: data.len() > 0
  • Postcondition: result.len() == 64
fn sha256_hmac(data: &Vec[Int], key: &Vec[Int]) -> Vec[Int]

HMAC-SHA-256 with key over the byte values.

  • Precondition: data.len() > 0
  • Precondition: key.len() > 0
  • Postcondition: result.len() == 32
fn sha512_initial_h0() -> Int

SHA-512 initial hash value H0 (FIPS 180-4).

fn sha512_initial_h1() -> Int

SHA-512 initial hash value H1 (FIPS 180-4).

fn sha512_initial_h2() -> Int

SHA-512 initial hash value H2 (FIPS 180-4).

fn sha512_initial_h3() -> Int

SHA-512 initial hash value H3 (FIPS 180-4).

fn sha512_initial_h4() -> Int

SHA-512 initial hash value H4 (FIPS 180-4).

fn sha512_initial_h5() -> Int

SHA-512 initial hash value H5 (FIPS 180-4).

fn sha512_initial_h6() -> Int

SHA-512 initial hash value H6 (FIPS 180-4).

fn sha512_initial_h7() -> Int

SHA-512 initial hash value H7 (FIPS 180-4).

fn sha512_k(index: Int) -> Int

SHA-512 round constant K[index] (0..79).

fn sha512(data: &Vec[Int]) -> Vec[Int]

SHA-512 digest of the byte values (64 bytes).

  • Postcondition: result.len() == 64
fn sha512_hex(data: &Vec[Int]) -> Str

Lowercase hex SHA-512 digest.

  • Precondition: data.len() > 0
  • Postcondition: result.len() == 128

sign.xi

fn ed25519_keypair() -> (Vec[UInt8], Vec[UInt8])

Generate a new Ed25519 keypair; the tuple is (sk, pk). Blocked in the current build (see module header).

fn ed25519_sign(sk: &Vec[UInt8], msg: &Vec[UInt8]) -> Vec[UInt8]

Sign a message with an Ed25519 secret key (64-byte signature). Blocked in the current build (see module header).

fn ed25519_verify(pk: &Vec[UInt8], msg: &Vec[UInt8], sig: &Vec[UInt8]) -> Bool

Verify an Ed25519 signature. Blocked in the current build.

fn ed25519_public_key(sk: &Vec[UInt8]) -> Vec[UInt8]

Derive the Ed25519 public key from a secret key. Blocked in the current build (see module header).

fn ed25519_keypair_from_seed(seed: &Vec[UInt8]) -> (Vec[UInt8], Vec[UInt8])

Deterministically expand a 32-byte seed; the tuple is (sk, pk). Blocked in the current build (see module header).

fn rsa_sign(key: &Vec[UInt8], msg: &Vec[UInt8], hash: Int) -> Result[Vec[UInt8], Str]

RSASSA-PKCS1-v1_5-style sign. Delegates to xiom.crypto.rsa_sign (raw textbook RSA over the small generated keys); the hash identifier is advisory (the flat implementation does not embed a digest identifier). Complexity: O(bitlen^3).

fn rsa_verify(key: &Vec[UInt8], msg: &Vec[UInt8], sig: &Vec[UInt8], hash: Int) -> Bool

Verify an RSA signature. Returns false on any error. Complexity: O(bitlen^3).

fn ecdsa_sign(curve: Int, sk: &Vec[UInt8], msg: &Vec[UInt8]) -> (Vec[UInt8], Vec[UInt8])

ECDSA sign; the tuple is (r, s). Blocked in the current build.

fn ecdsa_verify(curve: Int, pk: &Vec[UInt8], msg: &Vec[UInt8], r: &Vec[UInt8], s: &Vec[UInt8]) -> Bool

Verify an ECDSA signature. Blocked in the current build.

fn dsa_sign(p: &Vec[UInt8], q: &Vec[UInt8], g: &Vec[UInt8], x: &Vec[UInt8], msg: &Vec[UInt8]) -> (Vec[UInt8], Vec[UInt8])

DSA sign; the tuple is (r, s). Blocked in the current build.

fn dsa_verify(p: &Vec[UInt8], q: &Vec[UInt8], g: &Vec[UInt8], y: &Vec[UInt8], msg: &Vec[UInt8], r: &Vec[UInt8], s: &Vec[UInt8]) -> Bool

Verify a DSA signature. Blocked in the current build.