I have a question regarding use of keys in Ethereum for signing requests/data OUTSIDE of Ethereum.
Let's say I have a regular Ethereum EOA with an address and keypair. I now want to have a piece of information transferred to a third party (off-chain) and allow this third party to verify that this information came from me, i.e. the owner of the EOA in question. Approach: digitally sign the information with my private key associated with my EOA.
Now the question is, how the third party is verifying the signature. What he has is the signature, the data, and (lets assume we specified this) the address of my EOA.
For allowing him to verify the signature, he will need the public key of my EOA. To get this to him, I see two options:
- GIVE him the public key directly, e.g. by using a ERC1056 registry where I store the public key for each address. Now, I'd be required to verify on-chain (i.e. in Solidity) that the public key set as an attribute is matching the address (i.e. that the first 20 bytes of the hash of the public key are the same). Seems pretty cost-intensive Gas-wise to me. Anyhow First question: How to compute the address from a public key (string) in Solidity for such a check?
- Derive the public key off-chain (on the receiver's side) from the signature. I read this would be possible, I'm just unsure how exactly to do this. The recipient would then compute the public key, verify the signature, and verify that the signature was actually created by the EOA (address) it claims to be from. Hence, my second question: How to do this in Java? Is there a lib for that?
Is there a third, even better option?