0

Currently I try to understand signing and validating in Ethereum and Solidity. For this I have found the following tutorial: https://medium.com/@angellopozo/ethereum-signing-and-validating-13a2d7cb0ee3. What I don't understand is who can call eth_sign via JSON RPC? In my application the geth node will provide the JSON RPC but then everyone, also people who are not the owner of of the account, can sign their messages and afterwards verify this message as far as I understand.

The problem I need so solve is that in my application I want to sign data with a private key and in my Smart Contract I need to verify this data with a public key. How can I solve this issue when everyone can call eth_sign?

0

Calling eth_sign on an Ethereum node (Geth, Parity, ...) is only possible if you have an unlocked account in your node. In general, this is a bad idea for public nodes, as anyone will be able to sign transactions and messages for that account.

eth_sign is usually used with wallets like MetaMask, where a user can sign a message locally through their MetaMask instance. If you just need your users to sign a message with their own private key, you can use eth_sign for MetaMask, and use something like Web3.js or Ethers.js to sign messages with private keys. You don't need a JSON-RPC server for that.

  • Ok I understand, but in my case I have a C++ desktop application. I think for that I will need the JSON-RPC server to make transactions and calls. What is your opinion? In case of python or something I could use web3.py but for C++ there is no library – currImid Jan 12 at 23:03
  • I don't have experience with C++, but you should be able to use something like libsecp256k1, which has signing and verifying messages built-in. – Morten Jan 13 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.