[Ethereum] Why does ecrecover() take signature parameters (v,r,s) instead of the full signature

cryptographyecrecoversignaturesolidity

Is there any reason ecrecover() takes the (v, r, s) signature parameters instead of the full signature, given that these can be easily computed inside the function itself?

I am asking because developers usually need to compute these parameters from the full signature each time they need to use ecrecover(), which seems like an unnecessary repetitive process that could've been mitigated had ecrecover() took the full signature instead.

Best Answer

Signatures typically use v to store the signature and r,s to store the hashed data. I agree that using ecrecover adds extra complexity and by adding approve/transferFrom we get a bit of anonymity because we allow a 3rd party to extract tokens from our balance for a fee, usually in WETH or something similar.

People say that if we use signatures we become anonymous which is totally false since nothing is truly hidden on ethereum. More on that topic you can find out from here: https://medium.com/swlh/ethereum-aint-hiding-your-secrets-703e89088937

Signatures are more broadly used to identify the user that use Metamask. We make our user sign something that either contains a source of random entropy or has already been secretly hashed with our private key and provide after that we check who the author of the new signature is and provide a temporarily session using ecrecover.

The exact approach can be found here: https://programtheblockchain.com/posts/2018/02/17/signing-and-verifying-messages-in-ethereum/

Also if you want a better & more detailed approach to signatures you can find our more by looking at how DreamTeamToken made their implementation here: https://etherscan.io/address/0x82f4ded9cec9b5750fbff5c2185aee35afc16587#code It should be easy to update to Solidity 0.5 , if you have any struggles regarding this please let me know.

Related Solutions

addresses signature cryptography – Getting the wrong address back from ecrecover

Geth adds prefix to the message before siginig it in web3.eth.sign (see JSON-PRC spec). Without this it can be possible to trick user to sign transaction (more here).

So, the correct code to sign message with web3.eth.sign and recover address with ethereumjs-util.ecrecover or (Solidity's ecrecover) should add the prefix explicitly.

const util = require('ethereumjs-util')

const msg = new Buffer('hello');
const sig = web3.eth.sign(web3.eth.accounts[0], '0x' + msg.toString('hex'));
const res = util.fromRpcSig(sig);

const prefix = new Buffer("\x19Ethereum Signed Message:\n");
const prefixedMsg = util.sha3(
  Buffer.concat([prefix, new Buffer(String(msg.length)), msg])
);

const pubKey  = util.ecrecover(prefixedMsg, res.v, res.r, res.s);
const addrBuf = util.pubToAddress(pubKey);
const addr    = util.bufferToHex(addrBuf);

console.log(web3.eth.accounts[0],  addr);

There is misleading inconsistency with ethereumjs-testrpc as it does not prefix message before signing it in web3.eth.sign.

[Ethereum] How does ecrecover actually work

The prefix has no intrinsic connection to the signature or validation function. ecrecover is simply recovering the public key (and from there the address) used to sign the 32 bytes of data you're feeding it.

There is a convention in Ethereum for signed messages (ie not signed transactions) to prefix some data to a message before you sign it. This is done to make it harder to trick people into signing data that they don't intend to; For example, if you maliciously prompted someone to sign a transaction transferring the funds in their account to yours, and tried to get them to sign it thinking it was some message intended for some other system, your attack would fail because the client that signed it would prefix this arbitrary data to it, and that would stop it being a valid Ethereum transaction.

By convention the data used for this purpose in the Ethereum world is \x19Ethereum Signed Message:\n32, but anything else would have worked equally well. The same data would work for the same purpose with any other signature scheme, elliptic-curve-based or otherwise.

Best Answer

Related Solutions

addresses signature cryptography – Getting the wrong address back from ecrecover

[Ethereum] How does ecrecover actually work

Related Topic