signature: add MultipartSigner and MultipartVerifier (#1880)

This PR adds new traits for multipart messages: `MultipartSigner`,
`RandomizedMultipartSigner`, `RandomizedMultipartSignerMut` and
`MultipartVerifier`.

The idea here is to allow non-contiguous bytes to be passed, which is
necessary when the message has to be constructed from multiple sources
without wanting to allocate memory for a contiguous message. E.g. for
`no_std` environments or when the message is rather big but pre-hashing
is not applicable, e.g. PureEdDSA, ML-DSA or SLH-DSA.

I know this is a rather big breaking change, so let me know what you
think!

These new traits can be implemented by a bunch of crates:
- [x] `ecdsa`: RustCrypto/signatures#982
- [x] `ml-dsa`: RustCrypto/signatures#982
- [x]  `slh-dsa`: RustCrypto/signatures#982
- [x] `bign256`: RustCrypto/elliptic-curves#1221
- [x] `sm2`: RustCrypto/elliptic-curves#1221
- [x] `k256`: RustCrypto/elliptic-curves#1221
- [x] `dsa`: RustCrypto/signatures#982
- [x] `lms`: RustCrypto/signatures#982
- [x] `rsa`: RustCrypto/RSA#525
- [ ] `ed25519-dalek`

Resolves RustCrypto/signatures#959.

Author: daxpedda

signature/src/signer.rs

@@ -24,6 +24,20 @@ pub trait Signer<S> {
     fn try_sign(&self, msg: &[u8]) -> Result<S, Error>;
 }
 
+/// Equivalent of [`Signer`] but the message is provided in non-contiguous byte slices.
+pub trait MultipartSigner<S> {
+    /// Equivalent of [`Signer::sign()`] but the message
+    /// is provided in non-contiguous byte slices.
+    fn multipart_sign(&self, msg: &[&[u8]]) -> S {
+        self.try_multipart_sign(msg)
+            .expect("signature operation failed")
+    }
+
+    /// Equivalent of [`Signer::try_sign()`] but the
+    /// message is provided in non-contiguous byte slices.
+    fn try_multipart_sign(&self, msg: &[&[u8]]) -> Result<S, Error>;
+}
+
 /// Sign the provided message bytestring using `&mut Self` (e.g. an evolving
 /// cryptographic key such as a stateful hash-based signature), returning a
 /// digital signature.
@@ -103,6 +117,25 @@ pub trait RandomizedSigner<S> {
     ) -> Result<S, Error>;
 }
 
+/// Equivalent of [`RandomizedSigner`] but the message is provided in non-contiguous byte slices.
+#[cfg(feature = "rand_core")]
+pub trait RandomizedMultipartSigner<S> {
+    /// Equivalent of [`RandomizedSigner::sign_with_rng()`] but
+    /// the message is provided in non-contiguous byte slices.
+    fn multipart_sign_with_rng<R: CryptoRng + ?Sized>(&self, rng: &mut R, msg: &[&[u8]]) -> S {
+        self.try_multipart_sign_with_rng(rng, msg)
+            .expect("signature operation failed")
+    }
+
+    /// Equivalent of [`RandomizedSigner::try_sign_with_rng()`] but
+    /// the message is provided in non-contiguous byte slices.
+    fn try_multipart_sign_with_rng<R: TryCryptoRng + ?Sized>(
+        &self,
+        rng: &mut R,
+        msg: &[&[u8]],
+    ) -> Result<S, Error>;
+}
+
 /// Combination of [`DigestSigner`] and [`RandomizedSigner`] with support for
 /// computing a signature over a digest which requires entropy from an RNG.
 #[cfg(all(feature = "digest", feature = "rand_core"))]
@@ -147,6 +180,25 @@ pub trait RandomizedSignerMut<S> {
     ) -> Result<S, Error>;
 }
 
+/// Equivalent of [`RandomizedSignerMut`] but the message is provided in non-contiguous byte slices.
+#[cfg(feature = "rand_core")]
+pub trait RandomizedMultipartSignerMut<S> {
+    /// Equivalent of [`RandomizedSignerMut::sign_with_rng()`] but
+    /// the message is provided in non-contiguous byte slices.
+    fn multipart_sign_with_rng<R: CryptoRng + ?Sized>(&mut self, rng: &mut R, msg: &[&[u8]]) -> S {
+        self.try_multipart_sign_with_rng(rng, msg)
+            .expect("signature operation failed")
+    }
+
+    /// Equivalent of [`RandomizedSignerMut::try_sign_with_rng()`]
+    /// but the message is provided in non-contiguous byte slices.
+    fn try_multipart_sign_with_rng<R: TryCryptoRng + ?Sized>(
+        &mut self,
+        rng: &mut R,
+        msg: &[&[u8]],
+    ) -> Result<S, Error>;
+}
+
 /// Blanket impl of [`RandomizedSignerMut`] for all [`RandomizedSigner`] types.
 #[cfg(feature = "rand_core")]
 impl<S, T: RandomizedSigner<S>> RandomizedSignerMut<S> for T {

signature/src/verifier.rs

@@ -14,6 +14,13 @@ pub trait Verifier<S> {
     fn verify(&self, msg: &[u8], signature: &S) -> Result<(), Error>;
 }
 
+/// Equivalent of [`Verifier`] but the message is provided in non-contiguous byte slices.
+pub trait MultipartVerifier<S> {
+    /// Equivalent of [`Verifier::verify()`] but the
+    /// message is provided in non-contiguous byte slices.
+    fn multipart_verify(&self, msg: &[&[u8]], signature: &S) -> Result<(), Error>;
+}
+
 /// Verify the provided signature for the given prehashed message [`Digest`]
 /// is authentic.
 ///