3

I am trying to sign and verify a signature in Solidity. I understood that it is possible to verify a signature using ecrecover. However, I am not able to find any useful information on signing.

9

There might be implementations of signing in Solidity, but you shouldn't do it.

This is because in order to sign something, you will need a private key. Since every transaction is public on the blockchain, so will your private key that you use to sign something with.

Therefore, it doesn't make much sense to sign something in Solidity because everyone will be able to see your private key.

  • I think you have a misunderstanding of what 'signing' means. Signed messages are one way encryptions where you cannot get the original key from the signed hash, but able to decrypt the message and view the contents of the message. You cannot get the key used to sign the message, only if the user explicitly inserts the key inside the message itself, which I'm sure nobody in their right mind would do. – savageWays Feb 12 at 7:47
0

I do not agree with @erkt. Really not sure what that even means. Private Keys never go on the blockchain, unless you explicitly put it there. You can refer to some answers already provided here Can someone explain 'signing a transaction' and how its different from sending ether? There are reasons you would sign, but not all transactions need to be signed. Any message you send is implicitly signed and verified by the protocol (miners, verifiers). If you have any specific use case you can sign them before sending and verify using

ecrecover
  • I realize I'm coming across this late, but the question was "Is it possible to sign a message in Solidity?" I suppose Solidity code could be executed elsewhere, but I interpret the question to mean "Is it possible to sign a message in a smart contract?" And that's why @erkt's answer makes sense... you could technically sign something in a smart contract, but the private key used would necessarily be public (because the smart contract would need access to it to do the signing). – user19510 Feb 14 '18 at 3:27
  • Yes, I think what you are saying makes sense. That if someone is trying to do what people normally do in web apps of signing some content/message before sending it to some other app/user. Though it would be good if the questioner clarified what he/she actually meant. In case it was about signing a message from a contract to another - then the blockchain needs to see the message so you can only encrypt message data and not message. This thread has a lot of info ethereum.stackexchange.com/questions/6822/… – Shashikant Soni Feb 15 '18 at 6:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.