Sign data with a contract account

Question

Contracts are a special kind of accounts and I therefore suspect they have their own key pair (I could not verify this).

If that is the case, how, in Solidity, can I have a contract sign a piece of data and return the signature ?

nb: to verify the signature in solidity I would then simply need to verify that the account address is identical to what the ecrecover function returns;

Answer 1

Contracts don't have a private key, so they can't sign anything with it. In fact, contract addresses don't have anything to do with public/private key cryptography. Contract addresses are the hash of the address that created them + the transaction count of the address that created them. If you know an address, you can compute the hashes of all the contracts it can create, before it actually creates them on the blockchain.

You also shouldn't store a private key inside a contract, because it would be publicly visible in the blockchain and anyone could fake the signatures.

So, you can't sign anything with a contract in the cryptographic sense.

However, you could probably accomplish what you want by storing the hash of the data in your contract. For example:

pragma solidity ^0.4.17;
contract ContractThatCanSign
{
  mapping(bytes32 => bool) public signedDataHashes;

  function signData(bytes dataToSign) private
  {
    signedDataHashes[sha256(dataToSign)] = true;
  }

  function isDataSigned(bytes data) public view returns (bool)
  {
    return signedDataHashes[sha256(data)];
  }
}

Now you can call signData(...) to 'sign' something with your contract, from the Solidity code of your contract. And to verify that some piece of data has been signed you can call isDataSigned(...).