castrum 0.9.2 → 0.9.4

package/rust/crypto/bcrypt.rs

@@ -0,0 +1,89 @@
+// rust/crypto/bcrypt.rs — bcrypt password hashing.
+//
+// Pure-Rust (bcrypt crate, Blowfish-based). Unlike argon2id (memory-hard), a
+// bcrypt cost of `2^cost` is CPU-bound. We expose the standard `$2b$` PHC
+// string format so the output is interchangeable with Bun.password / bcryptjs.
+//
+// Pure-Rust core stays unit-testable; only the entry points use napi types.
+
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+
+/// bcrypt cost lower bound (bcrypt crate enforces 4..=31).
+pub const BCRYPT_MIN_COST: u32 = 4;
+/// bcrypt cost upper bound.
+pub const BCRYPT_MAX_COST: u32 = 31;
+
+/// Clamp a caller cost into the bcrypt-legal range (4..=31).
+#[inline]
+pub fn clamp_cost(cost: u32) -> u32 {
+    cost.clamp(BCRYPT_MIN_COST, BCRYPT_MAX_COST)
+}
+
+/// Hash a password with bcrypt at `cost`, returning a `$2b$` PHC string.
+#[napi]
+pub fn password_hash_bcrypt(password: Uint8Array, cost: u32) -> Result<String> {
+    let cost = clamp_cost(cost);
+    bcrypt::hash(password.as_ref(), cost).map_err(|e| Error::from_reason(e.to_string()))
+}
+
+/// Verify a password against a bcrypt `$2b$` PHC string.
+/// Returns false on ANY malformed hash (parity with argon2 `password_verify`).
+#[napi]
+pub fn password_verify_bcrypt(password: Uint8Array, hash: String) -> bool {
+    bcrypt::verify(password.as_ref(), &hash).unwrap_or(false)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn clamp_cost_bounds() {
+        assert_eq!(clamp_cost(0), BCRYPT_MIN_COST);
+        assert_eq!(clamp_cost(3), BCRYPT_MIN_COST);
+        assert_eq!(clamp_cost(4), 4);
+        assert_eq!(clamp_cost(10), 10);
+        assert_eq!(clamp_cost(31), 31);
+        assert_eq!(clamp_cost(99), BCRYPT_MAX_COST);
+    }
+
+    #[test]
+    fn bcrypt_roundtrip_and_wrong_password() {
+        let h = bcrypt::hash(b"password".as_slice(), 4).unwrap();
+        assert!(h.starts_with("$2b$04$"));
+        assert_eq!(h.len(), 60); // PHC bcrypt strings are exactly 60 chars
+        assert!(bcrypt::verify(b"password".as_slice(), &h).unwrap());
+        assert!(!bcrypt::verify(b"wrong".as_slice(), &h).unwrap());
+    }
+
+    #[test]
+    fn bcrypt_is_cost_sensitive_and_self_contained() {
+        // Same password, two hashes differ (random salt) but both verify.
+        let a = bcrypt::hash(b"pw".as_slice(), 4).unwrap();
+        let b = bcrypt::hash(b"pw".as_slice(), 4).unwrap();
+        assert_ne!(a, b);
+        assert!(bcrypt::verify(b"pw".as_slice(), &a).unwrap());
+        assert!(bcrypt::verify(b"pw".as_slice(), &b).unwrap());
+    }
+
+    #[test]
+    fn napi_wrapper_clamps_and_roundtrips() {
+        // cost 3 is clamped up to 4 (cheap) — exercises the napi boundary.
+        let h = password_hash_bcrypt(Uint8Array::new(b"pw".to_vec()), 3).unwrap();
+        assert!(h.starts_with("$2b$04$"));
+        assert!(password_verify_bcrypt(
+            Uint8Array::new(b"pw".to_vec()),
+            h.clone()
+        ));
+        assert!(!password_verify_bcrypt(
+            Uint8Array::new(b"nope".to_vec()),
+            h
+        ));
+        // Malformed hash -> false (not a throw), matching argon2 semantics.
+        assert!(!password_verify_bcrypt(
+            Uint8Array::new(b"pw".to_vec()),
+            "garbage".to_string()
+        ));
+    }
+}

package/rust/crypto/cookie_sign.rs

@@ -0,0 +1,169 @@
+// rust/crypto/cookie_sign.rs — signed cookies (`value.signature`, HMAC-SHA256).
+//
+// Composes the existing HMAC core + hex tables. The `CookieSigner`
+// higher-order instance precomputes the HMAC key once in its constructor and
+// reuses it across sign/verify calls.
+
+use aws_lc_rs::hmac;
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+
+use crate::util::bytes::{hex_decode_32, hex_encode_32};
+
+/// Zero-alloc core: `value` ++ "." ++ 64-hex into `out`. Returns the bytes
+/// written, or `None` on a too-small buffer. Used by the C-ABI (`bun:ffi`)
+/// path to avoid the signed-cookie Vec + copy.
+pub fn sign_cookie_into(value: &[u8], key: &hmac::Key, out: &mut [u8]) -> Option<usize> {
+    let need = value.len() + 1 + 64;
+    if out.len() < need {
+        return None;
+    }
+    let tag = hmac::sign(key, value);
+    let mut sig = [0u8; 64];
+    hex_encode_32(tag.as_ref(), &mut sig);
+    out[..value.len()].copy_from_slice(value);
+    out[value.len()] = b'.';
+    out[value.len() + 1..need].copy_from_slice(&sig);
+    Some(need)
+}
+
+/// `value` ++ "." ++ lowercase-hex(HMAC-SHA256(secret, value)).
+pub fn sign_cookie_bytes(value: &[u8], key: &hmac::Key) -> Vec<u8> {
+    let tag = hmac::sign(key, value);
+    let mut sig = [0u8; 64];
+    hex_encode_32(tag.as_ref(), &mut sig);
+    let mut out = Vec::with_capacity(value.len() + 1 + 64);
+    out.extend_from_slice(value);
+    out.push(b'.');
+    out.extend_from_slice(&sig);
+    out
+}
+
+/// Zero-alloc core: constant-time verify into `out` (the value without its
+/// signature). Returns the value length, or `None` on invalid signature /
+/// too-small buffer. Used by the C-ABI (`bun:ffi`) path to avoid the Vec.
+pub fn verify_cookie_into(signed: &[u8], key: &hmac::Key, out: &mut [u8]) -> Option<usize> {
+    let dot = signed.iter().rposition(|&b| b == b'.')?;
+    let (value, sig) = signed.split_at(dot);
+    let sig = &sig[1..];
+    if sig.len() != 64 {
+        return None;
+    }
+    let sig_bytes = hex_decode_32(sig)?;
+    if hmac::verify(key, value, &sig_bytes).is_err() {
+        return None;
+    }
+    if out.len() < value.len() {
+        return None;
+    }
+    out[..value.len()].copy_from_slice(value);
+    Some(value.len())
+}
+
+/// Constant-time verify; returns the signed value without its signature.
+pub fn verify_cookie_bytes(signed: &[u8], key: &hmac::Key) -> Option<Vec<u8>> {
+    let dot = signed.iter().rposition(|&b| b == b'.')?;
+    let (value, sig) = signed.split_at(dot);
+    let sig = &sig[1..];
+    if sig.len() != 64 {
+        return None;
+    }
+    let sig_bytes = hex_decode_32(sig)?;
+    hmac::verify(key, value, &sig_bytes)
+        .ok()
+        .map(|()| value.to_vec())
+}
+
+/// Constant-time verify; returns whether the signature matches, WITHOUT
+/// materializing the signed value. Same checks as [`verify_cookie_bytes`] but
+/// skips the `value.to_vec()` — used by the packed batch to avoid a discarded
+/// allocation per item.
+pub fn verify_cookie_bytes_bool(signed: &[u8], key: &hmac::Key) -> bool {
+    let Some(dot) = signed.iter().rposition(|&b| b == b'.') else {
+        return false;
+    };
+    let (value, sig) = signed.split_at(dot);
+    let sig = &sig[1..];
+    if sig.len() != 64 {
+        return false;
+    }
+    let Some(sig_bytes) = hex_decode_32(sig) else {
+        return false;
+    };
+    hmac::verify(key, value, &sig_bytes).is_ok()
+}
+
+#[napi]
+pub fn sign_cookie(value: Uint8Array, secret: Uint8Array) -> Buffer {
+    let key = hmac::Key::new(hmac::HMAC_SHA256, secret.as_ref());
+    Buffer::from(sign_cookie_bytes(value.as_ref(), &key))
+}
+
+#[napi]
+pub fn verify_cookie(signed: Uint8Array, secret: Uint8Array) -> Option<Buffer> {
+    let key = hmac::Key::new(hmac::HMAC_SHA256, secret.as_ref());
+    verify_cookie_bytes(signed.as_ref(), &key).map(Buffer::from)
+}
+
+/// Higher-order instance: HMAC key compiled once, reused across calls.
+#[napi]
+pub struct CookieSigner {
+    key: hmac::Key,
+}
+
+#[napi]
+impl CookieSigner {
+    #[napi(constructor)]
+    pub fn new(secret: Uint8Array) -> Self {
+        Self {
+            key: hmac::Key::new(hmac::HMAC_SHA256, secret.as_ref()),
+        }
+    }
+
+    #[napi]
+    pub fn sign(&self, value: Uint8Array) -> Buffer {
+        Buffer::from(sign_cookie_bytes(value.as_ref(), &self.key))
+    }
+
+    #[napi]
+    pub fn verify(&self, signed: Uint8Array) -> Option<Buffer> {
+        verify_cookie_bytes(signed.as_ref(), &self.key).map(Buffer::from)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn key(secret: &[u8]) -> hmac::Key {
+        hmac::Key::new(hmac::HMAC_SHA256, secret)
+    }
+
+    #[test]
+    fn sign_then_verify_roundtrip() {
+        let k = key(b"super-secret");
+        let value = b"session=abc123";
+        let signed = sign_cookie_bytes(value, &k);
+        assert!(signed.starts_with(value));
+        assert_eq!(signed[value.len()], b'.');
+        assert_eq!(verify_cookie_bytes(&signed, &k).unwrap(), value);
+    }
+
+    #[test]
+    fn verify_rejects_tampered() {
+        let k = key(b"super-secret");
+        let value = b"session=abc123";
+        let mut signed = sign_cookie_bytes(value, &k);
+        let last = signed.len() - 1;
+        signed[last] = if signed[last] == b'0' { b'1' } else { b'0' };
+        assert!(verify_cookie_bytes(&signed, &k).is_none());
+    }
+
+    #[test]
+    fn verify_rejects_wrong_secret_and_malformed() {
+        let signed = sign_cookie_bytes(b"x", &key(b"secret-a"));
+        assert!(verify_cookie_bytes(&signed, &key(b"secret-b")).is_none());
+        assert!(verify_cookie_bytes(b"no-dot", &key(b"s")).is_none());
+        assert!(verify_cookie_bytes(b"x.bad", &key(b"s")).is_none());
+    }
+}

package/rust/crypto/csrf.rs

@@ -0,0 +1,106 @@
+// rust/crypto/csrf.rs — CSRF tokens (32-byte random hex + HMAC-SHA256 signature).
+//
+// Token format: `<random-hex>.<hex(HMAC-SHA256(secret, random-hex))>`. The
+// `CsrfProtector` higher-order instance precomputes the HMAC key once.
+
+use aws_lc_rs::hmac;
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+
+use crate::util::bytes::{hex_decode_32, hex_encode};
+
+fn csrf_token_with_key(key: &hmac::Key) -> Result<Buffer> {
+    let mut rnd = [0u8; 32];
+    getrandom::fill(&mut rnd).map_err(|e| Error::from_reason(e.to_string()))?;
+    let mut rnd_hex = [0u8; 64];
+    hex_encode(&rnd, &mut rnd_hex);
+    let tag = hmac::sign(key, &rnd_hex);
+    let mut sig_hex = [0u8; 64];
+    hex_encode(tag.as_ref(), &mut sig_hex);
+    let mut out = Vec::with_capacity(64 + 1 + 64);
+    out.extend_from_slice(&rnd_hex);
+    out.push(b'.');
+    out.extend_from_slice(&sig_hex);
+    Ok(Buffer::from(out))
+}
+
+/// Constant-time verify; returns true when the signature matches.
+pub fn csrf_verify_with_key(token: &[u8], key: &hmac::Key) -> bool {
+    let Some(dot) = token.iter().position(|&b| b == b'.') else {
+        return false;
+    };
+    let (rnd_hex, sig_hex) = token.split_at(dot);
+    let sig_hex = &sig_hex[1..];
+    if rnd_hex.len() != 64 || sig_hex.len() != 64 {
+        return false;
+    }
+    let Some(sig) = hex_decode_32(sig_hex) else {
+        return false;
+    };
+    hmac::verify(key, rnd_hex, &sig).is_ok()
+}
+
+#[napi]
+pub fn csrf_token(secret: Uint8Array) -> Result<Buffer> {
+    let key = hmac::Key::new(hmac::HMAC_SHA256, secret.as_ref());
+    csrf_token_with_key(&key)
+}
+
+#[napi]
+pub fn csrf_verify(token: Uint8Array, secret: Uint8Array) -> bool {
+    let key = hmac::Key::new(hmac::HMAC_SHA256, secret.as_ref());
+    csrf_verify_with_key(token.as_ref(), &key)
+}
+
+/// Higher-order instance: HMAC key compiled once, reused across create/verify.
+#[napi]
+pub struct CsrfProtector {
+    key: hmac::Key,
+}
+
+#[napi]
+impl CsrfProtector {
+    #[napi(constructor)]
+    pub fn new(secret: Uint8Array) -> Self {
+        Self {
+            key: hmac::Key::new(hmac::HMAC_SHA256, secret.as_ref()),
+        }
+    }
+
+    #[napi]
+    pub fn create(&self) -> Result<Buffer> {
+        csrf_token_with_key(&self.key)
+    }
+
+    #[napi]
+    pub fn verify(&self, token: Uint8Array) -> bool {
+        csrf_verify_with_key(token.as_ref(), &self.key)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn key(secret: &[u8]) -> hmac::Key {
+        hmac::Key::new(hmac::HMAC_SHA256, secret)
+    }
+
+    #[test]
+    fn token_roundtrip() {
+        let k = key(b"csrf-secret");
+        let token = csrf_token_with_key(&k).unwrap();
+        let t = token.as_ref();
+        assert_eq!(t.len(), 64 + 1 + 64);
+        assert_eq!(t[64], b'.');
+        assert!(csrf_verify_with_key(t, &k));
+    }
+
+    #[test]
+    fn rejects_wrong_secret_and_malformed() {
+        let token = csrf_token_with_key(&key(b"secret-a")).unwrap();
+        assert!(!csrf_verify_with_key(token.as_ref(), &key(b"secret-b")));
+        assert!(!csrf_verify_with_key(b"tooshort", &key(b"s")));
+        assert!(!csrf_verify_with_key(b"x.bad", &key(b"s")));
+    }
+}

package/rust/crypto/ed25519.rs

@@ -0,0 +1,215 @@
+// rust/crypto/ed25519.rs — Ed25519 keypair generation + sign/verify.
+//
+// Backend-framework feature: EdDSA (Ed25519) signing for JWT auth. Uses
+// aws-lc-rs (already a dependency for HMAC/argon2/etc.) — no new crates.
+//
+// Pure-Rust core (no napi types in signatures) stays unit-testable; only the
+// entry points use napi types — same split as the other crypto modules.
+//
+// Key formats (the `.env` contract consumed by @ignex/native):
+//   - private key: PKCS#8 v1 DER (RFC 5208/8410, 48 bytes) — byte-identical
+//     to Node `crypto.generateKeyPairSync("ed25519").privateKey.export({type:
+//     "pkcs8", format: "der"})`.
+//   - public key:  SPKI DER (RFC 5280/8410, 44 bytes) — byte-identical to
+//     Node `publicKey.export({type: "spki", format: "der"})`.
+// The raw 32-byte seed/public are recovered at the core boundary so the pure
+// core only deals in raw bytes (aws-lc-rs `Ed25519KeyPair`/`UnparsedPublicKey`
+// consume raw Ed25519 keys).
+
+use aws_lc_rs::rand::SystemRandom;
+use aws_lc_rs::signature::{Ed25519KeyPair, KeyPair as _, UnparsedPublicKey, ED25519};
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+
+pub const ED25519_SIGNATURE_LEN: usize = 64;
+pub const ED25519_SEED_LEN: usize = 32;
+pub const ED25519_PUBLIC_KEY_LEN: usize = 32;
+/// PKCS#8 v1 DER length for an Ed25519 private key (RFC 8410: 48 bytes).
+pub const ED25519_PKCS8_V1_LEN: usize = 48;
+/// SPKI DER length for an Ed25519 public key (RFC 8410: 44 bytes).
+pub const ED25519_SPKI_LEN: usize = 44;
+
+/// The fixed SPKI DER header (AlgorithmIdentifier + BIT STRING wrapper) that
+/// precedes the raw 32-byte Ed25519 public key — matches Node/OpenSSL.
+const SPKI_HEADER: [u8; 12] = [
+    0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+];
+
+/// Build the RFC 8410 SPKI DER encoding of a raw 32-byte Ed25519 public key.
+pub fn spki_der(raw_public_key: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(ED25519_SPKI_LEN);
+    out.extend_from_slice(&SPKI_HEADER);
+    out.extend_from_slice(raw_public_key);
+    out
+}
+
+/// Recover the raw 32-byte public key from SPKI DER (44 bytes) — also accepts
+/// the raw 32-byte form so callers can skip the DER round trip.
+pub fn raw_public_key(public_der: &[u8]) -> Option<&[u8]> {
+    match public_der.len() {
+        ED25519_PUBLIC_KEY_LEN => Some(public_der),
+        ED25519_SPKI_LEN if public_der.starts_with(&SPKI_HEADER) => {
+            Some(&public_der[SPKI_HEADER.len()..])
+        }
+        _ => None,
+    }
+}
+
+/// Generate an Ed25519 keypair → `(pkcs8_v1_private_der, spki_public_der)`.
+///
+/// `None` only if the OS CSPRNG fails (effectively never).
+pub fn generate_keypair() -> Option<(Vec<u8>, Vec<u8>)> {
+    let rng = SystemRandom::new();
+    let document = Ed25519KeyPair::generate_pkcs8v1(&rng).ok()?;
+    let private_der = document.as_ref().to_vec();
+    let pair = Ed25519KeyPair::from_pkcs8(&private_der).ok()?;
+    let public_der = spki_der(pair.public_key().as_ref());
+    Some((private_der, public_der))
+}
+
+/// Sign `msg` with an Ed25519 private key (PKCS#8 v1/v2 DER) → 64-byte sig.
+///
+/// `None` on an unparseable/invalid private key.
+pub fn sign(private_der: &[u8], msg: &[u8]) -> Option<Vec<u8>> {
+    let pair = Ed25519KeyPair::from_pkcs8(private_der).ok()?;
+    let sig = pair.try_sign(msg).ok()?;
+    Some(sig.as_ref().to_vec())
+}
+
+/// Verify a 64-byte Ed25519 signature over `msg` with an SPKI DER (or raw
+/// 32-byte) public key. Constant-time signature verification (aws-lc-rs).
+pub fn verify(public_der: &[u8], msg: &[u8], sig: &[u8]) -> bool {
+    let Some(raw) = raw_public_key(public_der) else {
+        return false;
+    };
+    UnparsedPublicKey::new(&ED25519, raw)
+        .verify(msg, sig)
+        .is_ok()
+}
+
+// ── NAPI entry points ──────────────────────────────────────────
+
+/// An Ed25519 keypair serialized for `.env` storage — PKCS#8 v1 DER (private)
+/// + SPKI DER (public), base64url encoded (RFC 7515 §2, no padding). The
+/// fields are camelCased by napi-rs → `{ privateKey, publicKey }` on the JS
+/// side.
+#[napi(object)]
+pub struct Ed25519Keypair {
+    /// PKCS#8 v1 DER private key, base64url.
+    pub private_key: String,
+    /// SPKI DER public key, base64url.
+    pub public_key: String,
+}
+
+/// Generate an Ed25519 keypair. Returns `{ privateKey, publicKey }` as
+/// base64url DER strings, ready to persist in `.env`.
+#[napi]
+pub fn generate_ed25519_keypair() -> Result<Ed25519Keypair> {
+    let (private_key, public_key) = generate_keypair()
+        .ok_or_else(|| Error::from_reason("ed25519 keypair generation failed (CSPRNG error)"))?;
+    Ok(Ed25519Keypair {
+        private_key: String::from_utf8(crate::crypto::base64::base64url_encode_bytes(&private_key))
+            .expect("base64url output is ASCII"),
+        public_key: String::from_utf8(crate::crypto::base64::base64url_encode_bytes(&public_key))
+            .expect("base64url output is ASCII"),
+    })
+}
+
+/// Sign `msg` with an Ed25519 private key (PKCS#8 DER) → 64-byte signature.
+#[napi]
+pub fn ed25519_sign(msg: Uint8Array, private_key: Uint8Array) -> Result<Buffer> {
+    sign(private_key.as_ref(), msg.as_ref())
+        .map(Buffer::from)
+        .ok_or_else(|| Error::from_reason("ed25519 sign failed (invalid private key)"))
+}
+
+/// Verify a 64-byte Ed25519 signature over `msg` with an SPKI DER (or raw
+/// 32-byte) public key.
+#[napi]
+pub fn ed25519_verify(msg: Uint8Array, signature: Uint8Array, public_key: Uint8Array) -> bool {
+    verify(public_key.as_ref(), msg.as_ref(), signature.as_ref())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// RFC 8032 §7.1 test vector 1.
+    const TEST_SECRET: [u8; 32] = [
+        0x9d, 0x61, 0xb1, 0x9d, 0xef, 0xfd, 0x5a, 0x60, 0xba, 0x84, 0x4a, 0xf4, 0x92, 0xec, 0x2c,
+        0xc4, 0x44, 0x49, 0xc5, 0x69, 0x7b, 0x32, 0x69, 0x19, 0x70, 0x3b, 0xac, 0x03, 0x1c, 0xae,
+        0x7f, 0x60,
+    ];
+    const TEST_PUBLIC: [u8; 32] = [
+        0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7, 0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64, 0x07,
+        0x3a, 0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25, 0xaf, 0x02, 0x1a, 0x68, 0xf7, 0x07,
+        0x51, 0x1a,
+    ];
+    const TEST_SIGNATURE: [u8; 64] = [
+        0xe5, 0x56, 0x43, 0x00, 0xc3, 0x60, 0xac, 0x72, 0x90, 0x86, 0xe2, 0xcc, 0x80, 0x6e, 0x82,
+        0x8a, 0x84, 0x87, 0x7f, 0x1e, 0xb8, 0xe5, 0xd9, 0x74, 0xd8, 0x73, 0xe0, 0x65, 0x22, 0x49,
+        0x01, 0x55, 0x5f, 0xb8, 0x82, 0x15, 0x90, 0xa3, 0x3b, 0xac, 0xc6, 0x1e, 0x39, 0x70, 0x1c,
+        0xf9, 0xb4, 0x6b, 0xd2, 0x5b, 0xf5, 0xf0, 0x59, 0x5b, 0xbe, 0x24, 0x65, 0x51, 0x41, 0x43,
+        0x8e, 0x7a, 0x10, 0x0b,
+    ];
+    const TEST_MESSAGE: &[u8] = b"";
+
+    fn pkcs8_v1_from_seed(seed: &[u8]) -> Vec<u8> {
+        // RFC 8410 PKCS#8 v1 for Ed25519: 48 bytes (16-byte prefix + seed).
+        let mut der = Vec::with_capacity(ED25519_PKCS8_V1_LEN);
+        der.extend_from_slice(&[
+            0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22,
+            0x04, 0x20,
+        ]);
+        der.extend_from_slice(seed);
+        der
+    }
+
+    #[test]
+    fn spki_der_round_trips() {
+        let der = spki_der(&TEST_PUBLIC);
+        assert_eq!(der.len(), ED25519_SPKI_LEN);
+        assert_eq!(raw_public_key(&der), Some(&TEST_PUBLIC[..]));
+        assert_eq!(raw_public_key(&TEST_PUBLIC), Some(&TEST_PUBLIC[..]));
+        assert_eq!(raw_public_key(&der[..4]), None);
+        assert_eq!(raw_public_key(&[]), None);
+    }
+
+    #[test]
+    fn verify_rfc8032_vector_1() {
+        let spki = spki_der(&TEST_PUBLIC);
+        assert!(verify(&spki, TEST_MESSAGE, &TEST_SIGNATURE));
+        // Signature is over the empty message — a non-empty message fails.
+        assert!(!verify(&spki, b"x", &TEST_SIGNATURE));
+        // Tampered signature fails.
+        let mut bad = TEST_SIGNATURE;
+        bad[0] ^= 0x01;
+        assert!(!verify(&spki, TEST_MESSAGE, &bad));
+    }
+
+    #[test]
+    fn sign_matches_rfc8032_vector_1() {
+        let pkcs8 = pkcs8_v1_from_seed(&TEST_SECRET);
+        let sig = sign(&pkcs8, TEST_MESSAGE).expect("sign should succeed");
+        assert_eq!(sig, TEST_SIGNATURE);
+        assert_eq!(sig.len(), ED25519_SIGNATURE_LEN);
+    }
+
+    #[test]
+    fn generate_sign_verify_round_trip() {
+        let (private_der, public_der) = generate_keypair().expect("keypair generation");
+        assert_eq!(private_der.len(), ED25519_PKCS8_V1_LEN);
+        assert_eq!(public_der.len(), ED25519_SPKI_LEN);
+
+        let msg = b"integration plan for ignex + ninox + rbac";
+        let sig = sign(&private_der, msg).expect("sign");
+        assert!(verify(&public_der, msg, &sig));
+        assert!(!verify(&public_der, b"tampered", &sig));
+    }
+
+    #[test]
+    fn invalid_key_rejected() {
+        assert!(sign(&[0u8; 10], b"msg").is_none());
+        assert!(!verify(&[0u8; 10], b"msg", &[0u8; 64]));
+    }
+}