# How can I validate subnet "signatures" on-chain? **URL:** \ **Category:** Developers\ **Created:** [October 28, 2021, 2:33pm UTC](https://forum.dfinity.org/t/how-can-i-validate-subnet-signatures-on-chain/8202 "2021-10-28T14:33:13Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![senior.joinu](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/senior.joinu/32/9240_2.png) [@senior.joinu](https://forum.dfinity.org/u/senior.joinu)\ **Post date:** [October 28, 2021, 2:33pm UTC](https://forum.dfinity.org/t/how-can-i-validate-subnet-signatures-on-chain/8202/1 "2021-10-28T14:33:13Z")
I was wondering through II’s sources and now I finally understand all the buzz around it. Subnet signatures are very cool, absolutely love it. Now I’m thinking about other use-cases which could be solved with this functionality. For example, let’s imagine this: - there is a canister A, registering users - there is a canister B, which only serves to users registered at canister A Me a week ago would come up with this straightforward solution: each time the user tries to interact with the canister B, it would make an inter-canister call to the canister A, to check whether the user is registered or not. > This solution would work fine, but since it contains an inter-canister interaction, it’s pretty slow. Now it seems like we could make it much faster (and maybe cheaper) using subnet signatures: once the user registers at canister A, it saves this fact to a hashtree and updates it’s certified data, which the user then could use to pass it to the canister B as a non-interactive proof of registration. > This solution is much better obviously. What do you think? Is there something else I missed? It seems like the only missing piece rn is how could one validate that this proof is actually signed by the real subnet within the IC. I know that IC’s pubkey is known, but this key is in chain-key-technology relations with the actual subnet key (_btw, how could one access it?_), which I don’t understand well enough. Is there a rust library for that? Thanks for the help! ---
**Author:** ![senior.joinu](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/senior.joinu/32/9240_2.png) [@senior.joinu](https://forum.dfinity.org/u/senior.joinu)\ **Post date:** [October 28, 2021, 5:21pm UTC](https://forum.dfinity.org/t/how-can-i-validate-subnet-signatures-on-chain/8202/2 "2021-10-28T17:21:38Z")
> [@senior.joinu](#): > > btw, how could one access it? Oh I watched some YT videos by Jan Camenisch on that topic an it seems like this key should be a part of the response the user gets alongside with the delegation issued by the NNS subnet, so it should actually be as simple as to perform an on-chain check if the certified data has this delegation and it is valid in terms of BLS verification. ---
**Author:** ![nomeata](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/nomeata/32/733_2.png) [@nomeata](https://forum.dfinity.org/u/nomeata)\ **Post date:** [October 28, 2021, 5:38pm UTC](https://forum.dfinity.org/t/how-can-i-validate-subnet-signatures-on-chain/8202/3 "2021-10-28T17:38:59Z")
Yes, especially for rust canisters it should be straight forward to include the existing validation code (found in the rust agent library) in a canister. One might wish that the system would provide it as a primitive on the system API, but it’s not really needed. The subnet key is part of the delegation thats part of the certificate, as you say. ---
**Author:** ![senior.joinu](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/senior.joinu/32/9240_2.png) [@senior.joinu](https://forum.dfinity.org/u/senior.joinu)\ **Post date:** [October 28, 2021, 7:54pm UTC](https://forum.dfinity.org/t/how-can-i-validate-subnet-signatures-on-chain/8202/4 "2021-10-28T19:54:59Z")
Thank you! I was thinking… but how do you tell if this certificate was created by exactly that canister in this subnet? I mean… what will happen if I deploy a malicious copy of II to the same subnet to which II is deployed? I know, the real II is now on NNS subnet and is immune to such an attack, but theoretically speaking? ---
**Author:** ![nomeata](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/nomeata/32/733_2.png) [@nomeata](https://forum.dfinity.org/u/nomeata)\ **Post date:** [October 28, 2021, 8:59pm UTC](https://forum.dfinity.org/t/how-can-i-validate-subnet-signatures-on-chain/8202/5 "2021-10-28T20:59:05Z")
The certificate of course includes the canister id whose certified data it certifies, and of course you need to check that it is the canister you expect it to be - the same checks that you would do when validating certificates off chain, no difference really. ---
**Author:** ![saikatdas0790](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/saikatdas0790/32/17147_2.png) [@saikatdas0790](https://forum.dfinity.org/u/saikatdas0790)\ **Post date:** [June 7, 2023, 3:10pm UTC](https://forum.dfinity.org/t/how-can-i-validate-subnet-signatures-on-chain/8202/6 "2023-06-07T15:10:53Z")
> [@senior.joinu](#): > > once the user registers at canister A, it saves this fact to a hashtree and updates it’s certified data, which the user then could use to pass it to the canister B as a non-interactive proof of registration. @senior.joinu Were you able to figure out if this is possible and how would one go about doing this? ---
**Author:** ![senior.joinu](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/senior.joinu/32/9240_2.png) [@senior.joinu](https://forum.dfinity.org/u/senior.joinu)\ **Post date:** [June 7, 2023, 4:05pm UTC](https://forum.dfinity.org/t/how-can-i-validate-subnet-signatures-on-chain/8202/7 "2023-06-07T16:05:59Z")
There is a great [repo](https://github.com/domwoe/access_control#token-based-access-control) by @domwoe about this (if I understood your question correctly).