guest-ed25519-signing: identity-from-seed backed by ed25519-dalek - #107
Merged
Conversation
…519-dalek An opt-in provisioning path for embedders that hold the identity's RFC 8032 32-byte seed in the clear (upstream iroh's SecretKey bytes). The interface is gated by the `guest-ed25519-signing` WIT feature and the matching cargo feature on iroh-endpoint-core and iroh-endpoint, so the default component keeps the crypto-split invariant: the private key stays behind the webcrypto handle and never enters guest memory. Core's Identity dispatches over a signer kind (webcrypto handle, or a dalek key under the feature); the seed path is covered natively by an RFC 8032 known-answer test. curve25519-dalek's automatic backend selection is left alone.
lannbot
enabled auto-merge
September 7, 2026 20:53
Merged
lannbot
pushed a commit
that referenced
this pull request
Sep 7, 2026
The host module API and its @PolyEngine constraints are unchanged, so this is a patch under the caret-honest scheme. It carries the `guest-ed25519-signing` feature (#107): an opt-in `identity-from-seed` interface, gated in WIT (`@unstable`) and in cargo, that mints an identity from an RFC 8032 seed and signs in-guest with ed25519-dalek. The published package and the attached iroh_endpoint.wasm are built without the feature, so their surface is the same as 0.6.1; the gated interface is available to source builds that enable it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an opt-in
identity-from-seedinterface that mints an identity from the RFC 8032 32-byte private-key seed and signs in-guest withed25519-dalek. It is gated by theguest-ed25519-signingWIT feature (@unstable) and the matching cargo feature oniroh-endpoint-coreandiroh-endpoint; the default build's component is unchanged and the crypto-split invariant (private key never in guest memory) holds for every other constructor. Theidentitydocs state the exception up front.core:Identitydispatches over a signer kind (webcrypto handle, or dalek key under the feature);from_seedrejects any non-32-byte input. RFC 8032 §7.1 vector 1 known-answer test for seed → endpoint-id and the signature.endpoint:generate!receivesfeatures: [...]only under the cargo feature (one macro, two cfg arms);from-seedexport.justfile:test/clippy/validate-witcover the feature shape too.build-componentsis unchanged — the shipped composition does not enable it.Automerge is armed.