Signing Data | OneKey Documents
Signing Data
Since OneKey makes cryptanalytic keys available to each user, websites can use these signatures for a kind of uses. here are a few guides related to specific function cases :
Signing Data with OneKey#
If you ’ d like to jump to some function key signature examples, you can visit this depository. If you ’ d like to read our JavaScript implementations of these methods, they are all available in the npm package eth-sig-util.
Reading: Signing Data | OneKey Documents
note that OneKey supports signing transactions with Trezor and Ledger hardware wallets. These hardware wallets presently entirely support signing data using the personal_sign method. If you have fuss logging in to a web site or dapp when using a Ledger or Trezor, the web site may be requesting you sign data via an unsupported method acting, in which case we recommend using your criterion OneKey account .
A Brief History#
There are presently six signing methods in OneKey, and you might wonder the history of these methods. Studying the history of these methods has some lessons in it for the emergent lessons of decentralized standards emergence. Our current five methods are :
eth_signpersonal_signsignTypedData(currently identical tosignTypedData_v1)signTypedData_v1signTypedData_v3signTypedData_v4
There are likely to be many more over time. When OneKey first started, the Provider API wasn ’ metric ton designed to be exposed to untrusted websites, and then some considerations weren ’ t taken equally badly as they were former. In particular, the method acting eth_sign is an open-ended sign language method acting that allows signing an arbitrary hashish, which means it can be used to sign transactions, or any early data, making it a dangerous phishing gamble. For this rationality, we make this method acting show the most frighten potential message to the drug user, and generally discourage using this method acting in production. however, some applications ( normally admin panels home to teams ) use this method acting for the sake of its comfort of use, and so we have continued to support it for the sake of not breaking the workflows of active projects. finally, the personal_sign specification was proposed, which added a prefix to the data so it could not impersonate transactions. We besides made this method acting able to display homo clear text when UTF-8 encoded, making it a popular option for web site logins. however, the text-prefix made those signatures expensive to verify on-chain, and so with the help of the 0xProtocol team and SpankChain, the EIP-712 specification was written. The strange part of EIP-712, and this decentralized standards ecosystem, is that the proposal changed respective times while retaining the same EIP. This means what we initially implemented as signTypedData was the earliest nominate interpretation, while early groups implemented subsequently versions under the lapp method acting name. To avoid compatibility issues between clients, we recommend using the hard-versioned method names signTypedData_v1 and signTypedData_v3. The missing v2 represents an mediator design that was implemented by the Cipher browser, so that we have board to implement it if there is ever enough developer demand for it. In the future, it may help to have method names include a hash of their claim marriage proposal, since in a decentralize ecosystem, there is no absolute source of accuracy of what a given name should map to. alternatively, we are forced to invent new patterns of collaboration, where we can drive forward and introduce, while simultaneously avoiding creating a brittle ecosystem by changing our meanings out from under the words. I hope this has been a useful introduction to the history of our signing methods !
Sign Typed Data v1#
This early interpretation of the specification lacked some former security system improvements, and should generally be neglected in favor of signTypedData_v3. The signTypedData syndicate has a few major design considerations :
- Cheap to verify on chain
- Still somewhat human readable
- Hard to phish signatures
If on-chain verifiability monetary value is a senior high school priority for you, you might want to consider it .
Sign Typed Data v3#
The method signTypedData_v3 presently represents the latest version of the EIP-712 specification, making it the most dependable method acting for signing cheap-to-verify data on-chain that we have even. This does not mean it is perfect, and we do already have a v4 in prototype stagecoach ( which supports recursive structs and arrays ), but we do intend to protect this namespace and keep it compatible going forwards. hopefully soon we will besides have thoroughly examples for parsing method acting remark into structs for confirmation on-chain ( great contribution opportunity ! )
Sign Typed Data v4#
The method signTypedData_v4 presently represents the latest version of the EIP-712 specification, with add support for arrays and with a break fixate for the way structs are encoded. This does not mean it is perfect, and does not mean we will not finally have a v5, but we do intend to protect this namespace and keep it compatible going forwards. hopefully soon we will besides have good examples for parsing method input into structs for verification on-chain ( great contribution opportunity ! )
Sign Typed Data Message Parameters#
domain : The Domain or domain signature is authoritative because it :
- Will only be accepted for a specific website/contract.
- Makes sure signatures are valid only where they are intended to be valid.
- Allows you have a unique contract that verifies the address.
- This is a bunch of information that restricts where the signature is valid.
- This is the domain of validity. Could be a contract, a url, ect.
- What needs to be put in here specifically what the DApp tells you.
- Makes sure your signature(s) don’t collide with other signatures.
chainId : The chainId distinguish you what chain you ‘re on and this is significant because :
- It makes sure signatures signed on Rinkeby are not valid on another chain, such as the Ethereum Main Net.
name : This is primarily for UX ( User Experience ) purposes .
- For example, as a user, you’re using an Ether Mail app and a dialog comes up for cryptokitties exchange, this would arouse suspicion due to what the name is on the signature.
verifyingContract : This is an extra layer of assurance. even if two developers end up creating an app with the like name, they will never have the same abridge address. ( You can add another field salt but it ‘s dispatch overkill and unnecessary )
- If you are unsure of the name this will show the contract responsible for message verification.
- This field will also take a url.
version : This tell you the current interpretation of the knowledge domain object. message : wholly open to what you would like the social organization of it to be. Every sphere is optional. Below is an exercise of signing typed data with OneKey. citation here : : : :tabs : options= ” { useUrlFragment : false } ” : : : tab HTML
<
div
>
<
h3
>
Sign Typed Data V4
h3
>
<
button
type
=
"
button
"
id
=
"
signTypedDataV4Button
"
>
sign typed data v4
button
>
div
>
: : : : : : pill JavaScript
signTypedDataV4Button
.
addEventListener
(
'click'
,
function
(
event
)
{
event
.
preventDefault
(
)
;
const
msgParams
=
JSON
.
stringify
(
{
domain
:
{
chainId
:
1
,
name
:
'Ether Mail'
,
verifyingContract
:
'0xCcCCccccCCCCcCCCCCCcCcCccCcCCCcCcccccccC'
,
version
:
'1'
,
}
,
message
:
{
contents
:
'Hello, Bob!'
,
attachedMoneyInEth
:
4.2
,
from
:
{
name
:
'Cow'
,
wallets
:
[
'0xCD2a3d9F938E13CD947Ec05AbC7FE734Df8DD826'
,
'0xDeaDbeefdEAdbeefdEadbEEFdeadbeEFdEaDbeeF'
,
]
,
}
,
to
:
[
{
name
:
'Bob'
,
wallets
:
[
'0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB'
,
'0xB0BdaBea57B0BDABeA57b0bdABEA57b0BDabEa57'
,
'0xB0B0b0b0b0b0B000000000000000000000000000'
,
]
,
}
,
]
,
}
,
primaryType
:
'Mail'
,
types
:
{
EIP712Domain
:
[
{
name
:
'name'
,
type
:
'string'
}
,
{
name
:
'version'
,
type
:
'string'
}
,
{
name
:
'chainId'
,
type
:
'uint256'
}
,
{
name
:
'verifyingContract'
,
type
:
'address'
}
,
]
,
Group
:
[
{
name
:
'name'
,
type
:
'string'
}
,
{
name
:
'members'
,
type
:
'Person[]'
}
,
]
,
Mail
:
[
{
name
:
'from'
,
type
:
'Person'
}
,
{
name
:
'to'
,
type
:
'Person[]'
}
,
{
name
:
'contents'
,
type
:
'string'
}
,
]
,
Person
:
[
{
name
:
'name'
,
type
:
'string'
}
,
{
name
:
'wallets'
,
type
:
'address[]'
}
,
]
,
}
,
}
)
;
var
from
=
web3
.
eth
.
accounts
[
0
]
;
var
params
=
[
from
,
msgParams
]
;
var
method
=
'eth_signTypedData_v4'
;
web3
.
currentProvider
.
sendAsync
(
{
method
,
params
,
from
,
}
,
function
(
err
,
result
)
{
if
(
err
)
return
console
.
dir
(
err
)
;
if
(
result
.
error
)
{
alert
(
result
.
error
.
message
)
;
}
if
(
result
.
error
)
return
console
.
error
(
'ERROR'
,
result
)
;
console
.
log
(
'TYPED SIGNED:'
+
JSON
.
stringify
(
result
.
result
)
)
;
const
recovered
=
sigUtil
.
recoverTypedSignature_v4
(
{
data
:
JSON
.
parse
(
msgParams
)
,
sig
:
result
.
result
,
}
)
;
if
(
ethUtil
.
toChecksumAddress
(
recovered
)
===
ethUtil
.
toChecksumAddress
(
from
)
)
{
alert
(
'Successfully recovered signer as '
+
from
)
;
}
else
{
alert
(
'Failed to verify signer when comparing '
+
result
+
' to '
+
from
)
;
}
}
)
;
}
)
Read more: Ciphertext indistinguishability - Wikipedia
;
: : : : : : :