How to verify a message's signature in motoko?

Developers
1

How to verify a message’s signature in motoko?

Is there a relevant module that I can import?

3 Likes
2

The system checks the signatures on ingress messages before they can reach canisters, and inter-canister messages don’t have signatures. It’s one of the selling points of our serverless-like architecture that canisters don’t have to deal with certain low-level stuff, including authentication. So I’m not sure what kind of signatures you mean?

2 Likes
3

I mean the content is at the parameter level, not at the system level.
For example:

actor A{
    public func verify(signature: Blob, signer: Principal): Bool{
         ...(how to verify the signer of "signature" is "signer"?)
    }
}

If I sign “hello world”, how can verify that the signature is mine in motoko?

4

That question still doesn’t quite make sense to me without more context. Which signature format is that? What protocol? And why do you want to verify signatures in a canister in the first place?

Maybe share a bit about your use case?

5

Verifying the signature of a message is one of the most common uses of smart contracts.
(the “message” is a string or bytes value, not canister’s call.)
Ethereum example: userA signs “hello world” with the EIP712 rule, then userB send a transaction with userA’s address and signature as arguments to the smart contract, which will be verified in the smart contract.

1 Like
6

Can use BLS or ECDSA signature algorithms. Any algorithm will do.
In motoko only need to implement the verification function.
It is the application’s business layer, not the IC system layer.

7

There are no such libraries for Motoko today. You could write one.

But why can’t userA send a signed message to the canister via the system layer, so that the system can authenticate the caller princpial for you?

8

This is the problem of business scenarios.
It is necessary to separate the act of sign-verifying from the act of sending a transaction.

With my current technical ability, it is difficult to write one by myself, I hope someone can write one. This is a valuable basic function.

Need to implement similar to ecrecover function in Solidity.

3 Likes
9

I suppose you can’t just fetch the principal’s public key, because that would violate the anonymity users have when using different IC apps. And if there is no verify function provided by the system, your frontend would need to generate new pub/private key pair and store the public key in the smart contract.
From there you could use rust, since it has ready crypto libraries.
I have seen only a sha256 function in motoko so far.

The following is not pub/priv key signing, but may work for some scenarios. With sha256 you could do the following. UserA runs sha256 on “message” and “some random secret”. Saves resulting hash in the smart contract, gives the message and secret to UserB. With that UserB uses the function, which verifies that the hash from these input matches the stored hash.

10

I would need to verify signatures using Ed25519 in Motoko canisters.
In the last two years, has there been some progress? Did someone create a Motoko package to solve this?

In Rust, I can easily do it using the ed25519_compact crate.

1 Like