4

I am looking for a way to sign a transaction manually by having the necessary input without using any libraries. I haven't found how the signing process exactly works anywhere hence why I am asking here. I do not want to use a library because I want to attempt and sign a raw transaction within Solidity without gas constraints.

EDIT: To clarify, I am not looking to broadcast the transaction to the network. I am simply aiming to return the signed message to the caller.

Improve this question
3
  • "...sign a raw transaction within Solidity without gas constraints." - If I understand correctly, then what you're proposing would expose the private key to the rest of the network. Is that going to be an issue in your setup? (Which I'm assuming is a private network.)
    – Richard Horrocks
    Commented Nov 14, 2017 at 17:08
  • As you correctly assumed, it is a private network so that wouldn't be an issue.
    – Alex Papageorgiou
    Commented Nov 14, 2017 at 17:09
  • When your contract sends a message it's already signed.
    – libertylocked
    Commented Nov 15, 2017 at 3:10

3 Answers 3

Reset to default
2

Generating an ECDSA signature requires elliptic curve scalar multiplication, which is quite expensive and would certainly not fit within the gas limit of any public blockchain. I don't know of any implementations in Solidity of secp256k1, and I honestly don't see any reason why you would want to generate signatures on-chain. Giving the private key to a contract makes it public, in which case you might as well just generate the signature off chain.

Improve this answer
4
  • Although this question is mostly for educational purposes, it could have it's own useful purpose in a private blockchain with filtered proxy RPC access points. Thank you for your input.
    – Alex Papageorgiou
    Commented Nov 16, 2017 at 11:31
  • Additionally, you'll need to find a way to generate random nonces on-chain, which is another hard problem
    – Tjaden Hess
    Commented Nov 16, 2017 at 14:37
  • What do you mean by random nonces? Aren't account nonces deterministic?
    – Alex Papageorgiou
    Commented Nov 16, 2017 at 14:55
  • Generating an ECDSA signature requires generating an unbiased pseudorandom nonce that must always be kept secret and never reused. en.wikipedia.org/wiki/…. You can generate them deterministically by hashing the message with the private key, though, since you're willing to expose the key to the whole network
    – Tjaden Hess
    Commented Nov 16, 2017 at 15:41
1

There's a very useful Medium article that explains step-by-step how a transaction is created - and signed.

However, a transaction usually needs to make its way into a node's mempool (and be broadcast to other nodes) - I'm not sure if this is possible from within a smart contract / Solidity.

I guess, as @Richard Horrocks pointed out, that if all of the nodes on the network had the private key then they would process a transaction (calling this smart contract) that would use the stored private key to sign a new transaction that could update the state of the Ethereum blockchain.

It might, however, be possible for the transaction created in the smart contract to call the same smart contract (or a similar one in a directed, cyclic graph of contracts) and if there aren't any gas constraints then the whole network would be locked up in an infinite loop.

This does seem to defeat the point of the secret / private key.

Improve this answer
0

Following on from Tjaden's answer...

As an illustration of the amount of gas this type of operation would require, there's a Solidity implementation of secp256k, here. It hasn't been touched for a year, so your mileage may vary.

From the README:

This is an implementation of ellipctic curve secp256k in 100% written in solidity.

And:

Calculate a public key from a private key takes about 800,000 gas.

From a cursory look at the contract, it doesn't appear to directly implement what you want, but it might be a good starting point.

Edit:

And for an even older implementation, see here.

Improve this answer
2
  • Thank you for providing a good starting point. This in conjunction with the medium post about transactions might be all I need although I'll leave this question open for some time more.
    – Alex Papageorgiou
    Commented Nov 16, 2017 at 11:30
  • I stand corrected, I guess someone has done it. Could be useful for ECDSA verification on different curves
    – Tjaden Hess
    Commented Nov 16, 2017 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.