Provide Utility for Verifying Signatures

[keefertaylor]

It would be useful to have an API that could verify signatures of payloads. Specifically, it would take:

1. A message
2. A public key (edpk...)
3. A signature (edsig...)

And would return a boolean indicating if the signature matches.

As a bonus, it could also support tz2/tz3 signature schemes (sppk/spsig, p2pk,p2sig, IIRC)

[jevonearth]

We have an implementation of verify here: https://github.com/ecadlabs/taquito/blob/master/packages/taquito-remote-signer/src/taquito-remote-signer.ts#L155

We will extract this, and probably promote this to a new API in the @taquito/utils package.

[tolmekian1453]

Here's a self-contained sig validation JS gist based on the above, meant for letting users prove that they own a wallet address. It ensures the public key matches the wallet address, though you could just ask for the public key alone. I also threw in validateSignature in the beginning to pre-screen malformed sigs: https://gist.github.com/tolmekian1453/9f5ac6648a1468efdf1fc159c1ed4e18

Alternatively, is there any way to get the public key of an address you don't control? It's not easy for end users to get their public key because, for some reason, Temple wallet doesn't display it anywhere. Easiest way I know of is using Beacon's built-in code editor at https://docs.walletbeacon.io/guides/sign-payload and adding in console.log("pubKey", (await dAppClient.getActiveAccount()).publicKey). I know you can't reverse the hash, but I'm just wondering if the blockchain stores the public keys somewhere.

[gwendall]

Utilities around verifying ownership of an address are necessary indeed. Thanks for the gist @tolmekian1453. Would you mind sharing how you built your signature? I am trying to implement a "login with wallet" mechanism but fail to validate the signature - I get a Failed to validate signature Error: outlen must be at least 16, was given undefined error.

Here is a gist of how I generate my signature, which is based on the taquito docs on signature (https://tezostaquito.io/docs/signing/#generating-a-signature-with-beacon-sdk).

https://gist.github.com/gwendall/f1434318986bda590ddac7962d21ba19

I then pass it to my server, re-create the bytes from the user nonce and use your verify function. Any idea what I'm doing wrong ?

[gwendall]

@tolmekian1453 @jevonearth Here is a small repro, any idea what I'm doing wrong ?

https://github.com/gwendall/sign-test