I was browsing some code at the go-ethereum and I noticed this method to validate the signature: https://github.com/ethereum/go-ethereum/blob/56dec25ae26bf749b93c3ea69538fabea60c5768/crypto/crypto.go#L263
For convenience this is the comment of the method:
ValidateSignatureValues verifies whether the signature values are valid with the given chain rules. The v value is assumed to be either 0 or 1.
But in fact the code doesn't seem to care at all for the v-value or the chain-id, which were topic that have been discussed here here here and finally here.
This is relevant for me as I'm not using crypto.sign instead I'm signing remotely from an HSM which has no context of the rules for a valid Ethereum signature.
My current code receives the signature returned from the HSM, splits it in r and s and then it passes them to the method in question like so:
isValidWithV0InHomestead := crypto.ValidateSignatureValues(byte(0), bigIntR, bigIntS, true) //true means homestead
isValidWithV1InHomestead := crypto.ValidateSignatureValues(byte(1), bigIntR, bigIntS, true) //true means homestead
as you would expect, the result is always the same with v=0 or v=1 that is:
valid if (s < curve.n / 2)
If this is correct, then I would only need to ask the HSM for a new signature until crypto.ValidateSignatureValues returns true.
ethereum-js seems to have a method ecrecover that takes v,s,r,chainId and it is a lot more involved and the same ecrecover method in go only needs the hash and the signature, but this is assuming that you generated the signature using crypto.sign which is not relevant for me.
So my question is: Is crypto.ValidateSignatureValues the right method to validate a signature when not using crypto.sign?
