/* ed25519.h -- EdDSA (RFC 8032), freestanding C99.
 *
 * Originally verify-only ("this kernel never signs; signing happens in
 * the host-side build tool") -- that was correct for capsule signing
 * (build-time, offline, a normal Linux binary can link libsodium/
 * OpenSSL) but conflicts with an on-device Zuse session minting new
 * user certs live at runtime, which requires the kernel itself to sign.
 * Decided (Phase 8, 2026-08-26): add real keygen/signing rather than
 * reshape that flow around verify-only. Entropy for keygen comes from
 * virtio_rng.h -- this header still has no RNG of its own, and takes a
 * caller-supplied seed rather than generating one, deliberately: keygen
 * has no business deciding how the seed's randomness quality is
 * guaranteed, that's the caller's job.
 *
 * Signing is NOT constant-time (same non-constant-time double-and-add
 * scalar_mult() verify already used) -- acceptable for this project's
 * actual threat model (an emulated/embedded kernel with no untrusted
 * co-tenant able to observe timing), not acceptable if this code is
 * ever reused somewhere with a real timing-attack surface.
 */
#ifndef ED25519_H
#define ED25519_H

#include <stdint.h>
#include <stddef.h>

/* Returns 1 if signature (64 bytes: R || S) is a valid Ed25519 signature
 * by pubkey (32 bytes, compressed point) over msg, else 0. Rejects
 * malformed inputs (S >= L, an undecodable point) as invalid rather than
 * faulting. */
int ed25519_verify(const uint8_t pubkey[32], const uint8_t *msg, size_t msg_len,
                    const uint8_t sig[64]);

/* Derive the public key (compressed point A = [a]B) from a 32-byte
 * seed. seed must be real, uniformly random entropy -- see this file's
 * header comment; ed25519_keygen() does not check or generate it. */
void ed25519_keygen(const uint8_t seed[32], uint8_t pubkey_out[32]);

/* Sign msg with the keypair derived from seed (the same seed passed to
 * ed25519_keygen() to obtain the matching public key). Deterministic
 * per RFC 8032 (the nonce is derived from seed + message, not fresh
 * randomness at sign time) -- only keygen needs real entropy, signing
 * needs none. */
void ed25519_sign(const uint8_t seed[32], const uint8_t *msg, size_t msg_len,
                   uint8_t sig_out[64]);

#endif /* ED25519_H */