crypto/ed25519,x/crypto/ed25519: add ValidPrivateKey() method

[kevinburke1]

I mistakenly used 32 bytes of random as a ed25519.PrivateKey and was extremely confused why signatures were not validating, was frantically triple checking the data I was attempting to sign/verify was the same on both ends, etc. I am an experienced user and if I can get tripped up by this, less experienced users could as well.

Adding a method for users to check whether a private key is valid could help alleviate this by suggesting a different source of error, and also helping users ensure that they are using valid keys to sign data. Roughly it could do:

// ValidPrivateKey reports whether in is a valid ed25519 private key.
func ValidPrivateKey(in []byte) bool {
        origKey := copy(in)
	in[0] &= 248
	in[31] &= 127
	in[31] |= 64
        return bytes.Equal(origKey, in)
}

You could also do func (p *PrivateKey) Valid() bool though I worry about letting people create a PrivateKey object and then determine whether that is valid or not, because they might try to use it later to sign stuff.

[julieqiu]

/cc @FiloSottile

[FiloSottile]

That's not what ValidPrivateKey would look like: PrivateKey is 32 bytes of random seed (which is not clamped) followed by the public key. Instead, you'd want to check that NewKeyFromSeed(pk.Seed()) == pk.

Sign checks the PrivateKey length, so are you sure you were using 32 bytes of random?

[kevinburke1]

Ah. I diagnosed the problem incorrectly. I assumed priv.Public() generated a public key from the private key using the same ScalarMult() functions that Keypair() does. However, it just returns priv[32:], the last 32 bytes.

The last 32 bytes of the private key I was using - the public key - was also read from crypto/rand so the public key returned by priv.Public() had no relationship to the private key.

I suppose if the private key is 64 bytes and the last 32 bytes are the public key, a function could also validate that relationship.

[FiloSottile]

I don't think we want to encourage manually creating private keys by adding a validation function. Keys should only be generated by GenerateKey or NewKeyFromSeed.

I kind of regret not making GenerateKey return only (PrivateKey, error), so that it would get associated in the godoc, but too late.