I am trying to sign and verify a signature in Solidity. I understood that it is possible to verify a signature using ecrecover. However, I am not able to find any useful information on signing.
Add a comment
|
4 Answers
There might be implementations of signing in Solidity, but you shouldn't do it.
This is because in order to sign something, you will need a private key. Since every transaction is public on the blockchain, so will your private key that you use to sign something with.
Therefore, it doesn't make much sense to sign something in Solidity because everyone will be able to see your private key.
-
5I think you have a misunderstanding of what 'signing' means. Signed messages are one way encryptions where you cannot get the original key from the signed hash, but able to decrypt the message and view the contents of the message. You cannot get the key used to sign the message, only if the user explicitly inserts the key inside the message itself, which I'm sure nobody in their right mind would do. Commented Feb 12, 2019 at 7:47
-
The signer would still need the pk though. To sign a message
sig = sign(message, pk)which a receiver canverify(sig, message)– GN.Commented Dec 16, 2020 at 19:40 -
Your assumption is that every Solidity file is a smart contract which becomes public on the blockchain. Here is a counter example: writing tests in Foundry. Another counter example is a script that creates signatures which you then privately distribute.– Peter HCommented Mar 21, 2023 at 22:43
I do not agree with @erkt. Really not sure what that even means. Private Keys never go on the blockchain, unless you explicitly put it there. You can refer to some answers already provided here Can someone explain 'signing a transaction' and how its different from sending ether? There are reasons you would sign, but not all transactions need to be signed. Any message you send is implicitly signed and verified by the protocol (miners, verifiers). If you have any specific use case you can sign them before sending and verify using
ecrecover
-
7I realize I'm coming across this late, but the question was "Is it possible to sign a message in Solidity?" I suppose Solidity code could be executed elsewhere, but I interpret the question to mean "Is it possible to sign a message in a smart contract?" And that's why @erkt's answer makes sense... you could technically sign something in a smart contract, but the private key used would necessarily be public (because the smart contract would need access to it to do the signing). Commented Feb 14, 2018 at 3:27
-
Yes, I think what you are saying makes sense. That if someone is trying to do what people normally do in web apps of signing some content/message before sending it to some other app/user. Though it would be good if the questioner clarified what he/she actually meant. In case it was about signing a message from a contract to another - then the blockchain needs to see the message so you can only encrypt message data and not message. This thread has a lot of info ethereum.stackexchange.com/questions/6822/… Commented Feb 15, 2018 at 6:29
Looks like there is no any way to sign something in contract code secure.
But if you want to create something which needs signing you can try to create incentives for people to sign data.
That may be possible solution.
The problem of verifying signatures have been eliminated by ERC1271. You might want to look at this https://eips.ethereum.org/EIPS/eip-1271
ERC-1271: Standard Signature Validation Method for Contracts
The idea is to create a data hash that you need to pass into txn and create a signature and sign it using your wallet. The function isValidSignature takes hash and signature and tries to verify it. If the signer is an EOA address, it will return the public key after decoding and verifying the signature. If the signer is a Smart Contract Wallet, it will return a magic value. But for your question, I think smart contract wallets are out of scope.
