Ed25519 over PKCS#8 / X.509 DER encodings, via the JDK provider (Java 15+).
The Tink path in hive-system.crypto.tink consumes RAW 32-byte key
material. Keyrings and key files in this ecosystem store the JDK encodings
instead — PKCS#8 for a private key, X.509 for a public one — which is what
KeyFactory consumes. Both encodings wrap the same 32 bytes and yield
byte-identical RFC 8032 signatures, so the two paths are interchangeable
over one key.
Selected with :crypto/key-encoding :der; :raw, the default, keeps the
Tink path. Signing takes the PKCS#8 private key as :crypto/key — the
public half is derived from it, so no keypair need be assembled.
Ed25519 over PKCS#8 / X.509 DER encodings, via the JDK provider (Java 15+). The Tink path in `hive-system.crypto.tink` consumes RAW 32-byte key material. Keyrings and key files in this ecosystem store the JDK encodings instead — PKCS#8 for a private key, X.509 for a public one — which is what KeyFactory consumes. Both encodings wrap the same 32 bytes and yield byte-identical RFC 8032 signatures, so the two paths are interchangeable over one key. Selected with `:crypto/key-encoding :der`; `:raw`, the default, keeps the Tink path. Signing takes the PKCS#8 private key as `:crypto/key` — the public half is derived from it, so no keypair need be assembled.
(generate-keypair)Fresh Ed25519 keypair as {:public <X.509 bytes> :private <PKCS#8 bytes>}.
Fresh Ed25519 keypair as {:public <X.509 bytes> :private <PKCS#8 bytes>}.
(sign {:crypto/keys [key data]})Detached signature over :crypto/data with the PKCS#8 :crypto/key.
Returns Result<{:crypto/signature ^bytes}>.
Detached signature over `:crypto/data` with the PKCS#8 `:crypto/key`.
Returns Result<{:crypto/signature ^bytes}>.(verify {:crypto/keys [pubkey data signature]})Check :crypto/signature over :crypto/data against the X.509
:crypto/pubkey. Returns Result<{:crypto/valid? boolean}> — a signature
that simply does not match is false, not an error.
Check `:crypto/signature` over `:crypto/data` against the X.509
`:crypto/pubkey`. Returns Result<{:crypto/valid? boolean}> — a signature
that simply does not match is `false`, not an error.cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |