7

If a user claims to own a public key is there a way that I can query metamask or a web3 object and say "hey this guy is telling me that he owns this public key is that true?"

I could ask the user to send me 0 eth as a proof, but then this requires them burning gas.

Thanks!

  • You mean private key? Public keys can be public by definition – Roland Kofler May 16 '18 at 11:21
3

As flygoing stated, you can use the web3.eth.sign function found here in the wiki.

web3.eth.sign(address, dataToSign, [, callback])
Signs data from a specific account. This account needs to be unlocked.

**Parameters**
String - Address to sign with.
String - Data to sign.
Function - (optional) If you pass a callback the HTTP request is made asynchronous. See this note for details.
**Returns**
String - The signed data.

After the hex prefix, characters correspond to ECDSA values like this:

r = signature[0:64]
s = signature[64:128]
v = signature[128:130]
Note that if you are using ecrecover, v will be either "00" or "01". As a result, in order to use this value, you will have to parse it to an integer and then add 27. This will result in either a 27 or a 28.

**Example**
var result = web3.eth.sign("0x135a7de83802408321b74c322f8558db1679ac20", "0x9dd2c369a187b4e6b9c402f030e50743e619301ea62aa4c0737d4ef7e10a3d49"); // second argument is web3.sha3("xyz")
console.log(result); // "0x30755ed65396facf86c53e6217c52b4daebe72aa4941d89635409de4c9c7f9466d4e

If you give the user you are trying to validate a specific message to sign using this method then as stated This account needs to be unlocked. You are able to validate the ownership of that address without using gas.

| improve this answer | |
6

You can use web3.eth.sign. It will prompt the user to sign a message with their private key. So you would give them a random message to sign, and if they can provide a signature matching the public key, you know they have it.

| improve this answer | |
1

Just wait for the first transaction and then verify the user

| improve this answer | |
0

Signing is the act of a user A “signing” data that anyone can validate came from user A. This is used in transactions to check if they are real.

Signing message does not burn gas if done via eth_sign

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.