Cryptography

Ed25519 lives in httk-core so that any httk module can sign manifests and output data without adding a cryptography dependency of its own. Signed project manifests in httk-workflow are the canonical consumer.

Ed25519

The public signing functions use standard 32-byte Ed25519 private seeds:

from httk.core.crypto import (
    ed25519_generate_seed,
    ed25519_public_key,
    ed25519_sign,
    ed25519_verify,
)

seed = ed25519_generate_seed()
public_key = ed25519_public_key(seed)
signature = ed25519_sign(seed, b"manifest digest")
assert ed25519_verify(public_key, b"manifest digest", signature)

ed25519_public_key derives a 32-byte public key from a seed. ed25519_sign returns a 64-byte RFC 8032 signature, and ed25519_verify returns whether it is valid. The default backend uses cryptography when it is installed and otherwise uses the stdlib RFC 8032 implementation.

Pass backend="pure" to force the portable implementation, or use ed25519_backend_available("cryptography") to test the optional backend. Installing httk-core[default] selects the cryptography dependency.