Signing and Verifying messages with COSE

[astrojarred]

I've been playing around with both the signing and verification of messages in python with pycardano, trying to follow the CIP-0008 for signing. I'm also trying to follow CIP-0003 such that messages signed by both pycardano vkeys and dApp wallets could be verified in python. My secondary end goal is be able to generate and verify JWT-like tokens generated by web3-cardano-token.

The aforementioned CIPs use COSE (CBOR Object Signing and Encryption), the algorithms for which are already written in a well-maintained python repository called pycose.

Is message signing and verification something that makes sense to be folded into pycardano, or do you think it's better off as a separate repository? The only new dependency needed would be the pycose library (pip install cose).

[cffls]

Hi Jarred,

Thanks for sharing the idea. It makes sense to implement CIP-0008 in pycardano, because CIP-0008 is already a widely adopted standard and it is application agnostic. If you want to work on this feature, I am more than happy to help with the design and maybe some implementations. Btw, if you haven't, please join pycardano's discord server: https://discord.gg/qT9Mn9xjgz 😊

[astrojarred]

Excellent, thanks for the offer and I'll see you on Discord!

[ops222]

Hello, Did you have any luck using pycose to verify the signature from signData? I'm working on the same thing. Btw, the discord link seems inactive.

[cffls]

Please try this one: https://discord.gg/qT9Mn9xjgz

[astrojarred]

Hey there @ops222, yes we are able to use pycose to verify signatures! Currently, different wallets (like Nami and Eternl) employ different methods for signing messages. We've been waiting to implement this into the package until the relevant CIP is finalized. In the meantime, feel free to check out this Gist:

https://gist.github.com/astrojarred/0ab3247c11d59e38fe56725f56d019b1

I'm already using this code in production to verify signatures from both Nami and Eternl. I have not tested it with Typhon or Flint. Do let me know if you have any questions about it, you can find me here and in Discord.

[ops222]

Thanks this perfect! It lines up well with how I started implementing it. I got stuck at verifying the kid by converting it to a payment_key because I was trying to convert it to a stake_key.

I've only played with Nami so far and it seems to be following CIP-30. I get bytes that can be decoded with CoseMessage.decode (after adding "d2"). Are you referring to another CIP?

[ops222]

Actually, nvm about my second statement, I was using the old interface for connecting to Nami.

[cffls]

CIP-8 has been integrated into pycardano thanks to @astrojarred . See this module here: https://github.com/cffls/pycardano/blob/main/pycardano/cip/cip8.py