[Ethereum] How does ecrecover actually work

ecrecoversolidity

I have a basic understanding of elliptic curves, so I'm more interested to find out how does ecrecover specifically verify signatures. It has rather weird requirements, like this prefix thing (excerpt taken from this thread):

bytes memory prefix = "\x19Ethereum Signed Message:\n32";
bytes32 prefixedHash = keccak256(prefix, hash);
return ecrecover(prefixedHash, v, r, s) == (Your Address);

There seems to be no clear topic on this matter on SE.

Best Answer

The prefix has no intrinsic connection to the signature or validation function. ecrecover is simply recovering the public key (and from there the address) used to sign the 32 bytes of data you're feeding it.

There is a convention in Ethereum for signed messages (ie not signed transactions) to prefix some data to a message before you sign it. This is done to make it harder to trick people into signing data that they don't intend to; For example, if you maliciously prompted someone to sign a transaction transferring the funds in their account to yours, and tried to get them to sign it thinking it was some message intended for some other system, your attack would fail because the client that signed it would prefix this arbitrary data to it, and that would stop it being a valid Ethereum transaction.

By convention the data used for this purpose in the Ethereum world is \x19Ethereum Signed Message:\n32, but anything else would have worked equally well. The same data would work for the same purpose with any other signature scheme, elliptic-curve-based or otherwise.

Related Solutions

[Ethereum] How does one properly use ecrecover to verify Ethereum signatures

I'm not sure if this is your only problem but at the very least, the v you're getting is wrong - it should be 27 or 28. Unfortunately a lot of signature functions won't give it to you, but you can just try both and see which one gives you the right address. No need to use hex for "v" - just literally feed it 27 or 28 as an int.

The other bit of trickiness that confused me for a while is that if you're going to hash bytes when you make the hash to pass to ecrecover, you have to make sure you were hashing bytes when you signed as well. I'm not sure if you're getting that right or not.

There's an example here if that helps: https://github.com/edmundedgar/realitykeys-examples-ethereum/tree/master/sponsor

[Ethereum] Does ecRecover in solidity expects the “\x19Ethereum Signed Message:\n”-prefix

According to issue #3731:

Geth prepends the string \x19Ethereum Signed Message:\n<length of message> to all data before signing it (https://github.com/ethereum/wiki/wiki/JSON-RPC#eth_sign). If you want to verify such a signature from Solidity, you'll have to prepend the same string in solidity before doing the ecrecovery.

Here's a working example I tested out using truffle:

Example.sol

pragma solidity ^0.4.0;

contract Example {
    function testRecovery(bytes32 h, uint8 v, bytes32 r, bytes32 s) returns (address) {
        bytes memory prefix = "\x19Ethereum Signed Message:\n32";
        bytes32 prefixedHash = sha3(prefix, h);
        address addr = ecrecover(prefixedHash, v, r, s);

        return addr;
    }
}

example.js (test)

var Example = artifacts.require('./Example.sol')

var Web3 = require('web3')
var web3 = new Web3(new Web3.providers.HttpProvider('http://localhost:8545'))

contract('Example', (accounts) => {
  var address = accounts[0]

  it('ecrecover result matches address', async function() {
    var instance = await Example.deployed()
    var msg = '0x8CbaC5e4d803bE2A3A5cd3DbE7174504c6DD0c1C'

    var h = web3.sha3(msg)
    var sig = web3.eth.sign(address, h).slice(2)
    var r = `0x${sig.slice(0, 64)}`
    var s = `0x${sig.slice(64, 128)}`
    var v = web3.toDecimal(sig.slice(128, 130)) + 27

    var result = await instance.testRecovery.call(h, v, r, s)
    assert.equal(result, address)
  })
})

Running test:

$ truffle test

Using network 'development'.

Compiling ./contracts/Example.sol...


  Contract: Example
    ✓ ecrecover result matches address (132ms)


  1 passing (147ms)

It's probably better to do the prefixing at the application level instead of in solidity contract since it'll be cheaper.

Signature – Verification of Externally-Created ECDSA Signatures in Solidity

Best Answer

Related Solutions

[Ethereum] How does one properly use ecrecover to verify Ethereum signatures

[Ethereum] Does ecRecover in solidity expects the “\x19Ethereum Signed Message:\n”-prefix

Related Topic