How to prove that a user owns their public key for free?

Question

If a user claims to own a public key is there a way that I can query metamask or a web3 object and say "hey this guy is telling me that he owns this public key is that true?"

I could ask the user to send me 0 eth as a proof, but then this requires them burning gas.

Thanks!

Answer 1

As flygoing stated, you can use the web3.eth.sign function found here in the wiki.

web3.eth.sign(address, dataToSign, [, callback])
Signs data from a specific account. This account needs to be unlocked.

**Parameters**
String - Address to sign with.
String - Data to sign.
Function - (optional) If you pass a callback the HTTP request is made asynchronous. See this note for details.
**Returns**
String - The signed data.

After the hex prefix, characters correspond to ECDSA values like this:

r = signature[0:64]
s = signature[64:128]
v = signature[128:130]
Note that if you are using ecrecover, v will be either "00" or "01". As a result, in order to use this value, you will have to parse it to an integer and then add 27. This will result in either a 27 or a 28.

**Example**
var result = web3.eth.sign("0x135a7de83802408321b74c322f8558db1679ac20", "0x9dd2c369a187b4e6b9c402f030e50743e619301ea62aa4c0737d4ef7e10a3d49"); // second argument is web3.sha3("xyz")
console.log(result); // "0x30755ed65396facf86c53e6217c52b4daebe72aa4941d89635409de4c9c7f9466d4e

If you give the user you are trying to validate a specific message to sign using this method then as stated This account needs to be unlocked. You are able to validate the ownership of that address without using gas.

Answer 2

You can use web3.eth.sign. It will prompt the user to sign a message with their private key. So you would give them a random message to sign, and if they can provide a signature matching the public key, you know they have it.

Answer 3

Just wait for the first transaction and then verify the user

Answer 4

Signing is the act of a user A “signing” data that anyone can validate came from user A. This is used in transactions to check if they are real.

Signing message does not burn gas if done via eth_sign