Added address Verification #1

gavinharris-dev · 2021-11-30T11:44:57Z

Added the method verifyAddress; this method takes the provided Public Key and Address (supplied by the signing process signData) and we attempt to recreate the address.

To recreate the address we get the stakeKeyHash and combine it with the publicKeyHash to create a 'reconstructed' address. We then verify that both the 'reconstructed' address matches the address provided when signing the data (token).

This change is to try and prevent actors spoofing a token. Prior to this change, in theory (in my head so it may not be correct) a user could create a signed token with any address as there was no verification that the Public Key (used to verify that the token has not been tampered with) belongs to the address that this token is making claim to.

gavinharris-dev · 2021-11-30T11:53:24Z

I have to add reference to https://cardano.stackexchange.com/q/2498/4255
And give kudos to: https://cardano.stackexchange.com/users/2815/jeroen

src/lib/verify.js

pyropy · 2021-12-01T07:35:17Z

Linking PR with the Issue ticket #2

pyropy · 2022-01-21T19:51:35Z

Hey buddy, do you need some help with this? Give me a shout if I can help somehow :D

gavinharris-dev · 2022-01-22T02:09:18Z

Really sorry! Work and life got in the way of this one!! I will schedule a few hours next week to get this done.

pyropy · 2022-01-24T12:49:41Z

Really sorry! Work and life got in the way of this one!! I will schedule a few hours next week to get this done.

No problems, I completely understand. Take your time and let me know if you need anything 😄

gavinharris-dev · 2022-02-09T00:47:26Z

Do we want to look at getting this Merged? If you have time to do a further review?

pyropy · 2022-02-09T11:37:00Z

Do we want to look at getting this Merged? If you have time to do a further review?

Hi there, I'll take a look at it later today ⏰

CIP30 changes

…no-token into feature/cip30

Feature/cip30

I hate JS!

RewardAddress is not a standalone Object!

Check this out.

…ould use TypeScript

pyropy · 2022-03-16T07:33:17Z

@gavinharris-dev Hi, I see that you're making quite a lot of progress. Request review when you are ready.

Also, if you could remove the commited dist directory it would be awesome 🙌🏻

chrizcros · 2022-04-07T13:54:28Z

Hey @gavinharris-dev @pyropy wanted to check if there is any progress on this pull request?
When I test out the PR I got the error:

Error: "signature" argument should be a function that returns a signature string (Promise<string>) at _callee$ (sign.ts?b2ef:9:1) at tryCatch (runtime.js?96cf:63:1) at Generator.invoke [as _invoke] (runtime.js?96cf:294:1) at Generator.eval [as next] (runtime.js?96cf:119:1) at asyncGeneratorStep (asyncToGenerator.js?1da1:3:1) at _next (asyncToGenerator.js?1da1:25:1)

The reason is that api.signData is a string and not an object:

await Web3Token.sign((msg: string) => api.signData(address, toHex(msg)), '1d')

Do you have an idea how to handle that?

gavinharris-dev · 2022-04-18T02:48:20Z

Hi @bieric,

Here is an example that I am currently using in our Application. This is using my main branch i.e.,

"dependencies": { 
...
"web3-cardano-token": "gavinharris-dev/web3-cardano-token",
...
}

const getLoginToken = async (wallet) => {
  const address = await wallet.getUsedAddresses();

  if (!address || address.length === 0) {
    throw new Error('No wallet address');
  }

  return await Web3Token.sign(async (msg) => {
    return await wallet.signData(address[0], Buffer.from(msg).toString('hex'));
  });
};

Wallet.signData (according to CIP30 and implemented on Nami Wallet) will return the type DataSignature which is structured as such:

type DataSignature = {|
  signature:cbor\<COSE_Sign1>,
  key: cbor\<COSE_Key>,
|};

The DataSignature type is the expected return type for the Callback method provided into Web3Token.sign.

Note: Older versions of Nami Wallet (and perhaps other Wallets) returned a CBOR String as a result of the signData method, I should probably (when allowing users to link a wallet) check that not only is the Wallet supported, but also the Version provided is supported.

In terms of getting this PR merged in, I think (with the extend of the code changes) it would be highly useful to get the code reviewed again. Also really need to work out how to write some Unit Tests for these changes! I need to verify several things now:

Provided Token is Signed correctly; i.e., with the Private Key of the supplied Address,
Provided Token has not been tampered with, i.e., the Signature matches a 'recalculated' signature,
Provided Token is still 'in date'; I.E., has not expired,

I also think that there is a discussion around packaging; I have on my branch the Dist folder where I have the build artifacts available. This is probably undesirable but I'm too new to developing JS modules to know what the process should be; so any tips would be appreciated!

Ref:
https://github.com/cardano-foundation/CIPs/tree/master/CIP-0030#apisigndataaddr-address-payload-bytes-promisedatasignature

bitlands · 2022-04-18T11:12:40Z

@gavinharris-dev Thank you a lot for your detailed description!

Unfortunately, I have still some problems.
I'm trying it with Nami and Eternl wallet.

I guess eternl is still returning the CBOR string.

Nami has other problems (v3.2.1):

My questions:

What wallet/version do you use?
When a wallet returns a CBOR string do you have an example of how to handle it?

I also want to help maintain this repository since it could be a huge deal for the Cardano community but first I would like to have a working example to better understand it.
Thank you in advance!

gavinharris-dev · 2022-04-18T22:21:18Z

What wallet/version do you use?

We use Nami 3.2.1 and get good results. The error you are getting with Nami appears to be thrown in 3 places (in the Nami code):

https://github.com/Berry-Pool/nami-wallet/blob/11fcd502504f9ce0fa22ef8f108892e2f3828aa8/src/api/extension/index.js#L694

https://github.com/Berry-Pool/nami-wallet/blob/11fcd502504f9ce0fa22ef8f108892e2f3828aa8/src/api/extension/index.js#L721

Without seeing how you are using the library I'm not really able to help much here. Perhaps print out the inputs that you are sending to signData so that you can verify that they are valid HEX encoded values (you need to verify that the address input is in-fact an address and that the 'data' can be decoded back to plain text).

Perhaps if you can post a small example that we can work through it?

When a wallet returns a CBOR string do you have an example of how to handle it?

This is a great question; @pyropy should we be looking to support the 'old' sign data structure? It looks like the community has settled towards the CIP30 version of signData and so my opinion would be that we would not support the return of CBOR string.

@pyropy Do these discussions need to move into an Issue / Discussion rather that a Pull Request?

bitlands · 2022-04-22T07:51:00Z

@gavinharris-dev Thank you a lot I've found the issue. I've decoded the address to the readable string and not let it in the hex format. That's why the signer fails.

Thank you again!

pyropy · 2022-05-04T15:57:59Z

Hey folks, sorry for being absent lately -- I've focused mostly on my day job.

@gavinharris-dev When wallet returns CBOR I guess simplest way is for user to simply handle the decoding process -- we should always stick with the CIP implementation.

Is the PR ready to be reviewed?

chrizcros · 2022-05-04T16:01:26Z

@pyropy I agree. Yes I think so. I've tested it with Nami and it works good.

pyropy

Everything looks awesome! Thank you so much for your contributions so far 🎉

I'll test it and once we're sure that it's working properly I'm going to merge it finally 😮‍💨

pyropy · 2022-05-04T15:59:46Z

package.json

@@ -1,12 +1,13 @@
 {
  "name": "web3-cardano-token",
-  "version": "0.0.12",
+  "version": "0.1.17",


I would stick with version 0.1.0 here perhaps. If the API has no breaking changes then I would just increase it to 0.0.13.

pyropy · 2022-05-04T16:00:23Z

src/browser.d.ts

+};
+
+export default Web3Token;
+


Types ❤️

pyropy · 2022-05-04T16:01:10Z

src/browser.d.ts

+
+type Signer = (msg: string) => PromiseLike<COSESign1>;
+
+export function sign(


Can we stick with arrow function types? Also we should make first letter of the function uppercase ⏫

pyropy · 2022-05-04T16:01:46Z

src/lib/verify.js

@@ -1,8 +1,15 @@
 import Base64 from "base-64";
 import parseAsHeaders from "parse-headers";
 import { Buffer } from "buffer";
-import Loader from "./loader";
+import Loader from "./loader.js";


Is .js needed for import?

No its not needed

chrizcros · 2022-05-04T16:04:36Z

@pyropy Do you have an example how to decode the cbor string to make other wallets compatible?

pyropy · 2022-05-04T16:08:08Z

@bieric You should be able to decode CBOR using some libraries -- for example here's an JS library for encoding/decoding CBOR

https://github.com/paroga/cbor-js

Fix up the version

Gavin Harris and others added 4 commits November 24, 2021 11:16

Added address verification check

cf5561b

Version bump

8fe3bf5

Fixed some bugs in verify

6173f04

Merge branch 'main' of github.com:gavinharris-dev/web3-cardano-token

053964d

pyropy reviewed Dec 1, 2021

View reviewed changes

src/lib/verify.js Outdated Show resolved Hide resolved

pyropy reviewed Dec 1, 2021

View reviewed changes

src/lib/verify.js Outdated Show resolved Hide resolved

src/lib/verify.js Outdated Show resolved Hide resolved

src/lib/verify.js Show resolved Hide resolved

gavinharris-dev and others added 2 commits January 22, 2022 13:37

Merge branch 'pyropy:main' into main

072ae8f

Updated for Review Comments

33303ca

Gavin Harris and others added 12 commits February 22, 2022 21:13

CIP30 changes

b457038

Merge branch 'main' into feature/cip30

d209c8c

Merge pull request #1 from gavinharris-dev/feature/cip30

6e686e6

CIP30 changes

Bumpped version

f78a184

Merge branch 'feature/cip30' of github.com:gavinharris-dev/web3-carda…

83282d4

…no-token into feature/cip30

Merge pull request #2 from gavinharris-dev/feature/cip30

19bb462

Feature/cip30

RewardAddress is not a standalone Object!

da1dc9b

I hate JS!

Merge pull request #3 from gavinharris-dev/feature/cip30

8d3f6be

RewardAddress is not a standalone Object!

Check this out.

ed9b2a1

Merge pull request #4 from gavinharris-dev/feature/cip30

271a125

Check this out.

Fix issue with Verification. There are still lots to fix; if only I c…

2c9bb35

…ould use TypeScript

Fix issue with Verification. There are still lots to fix; if only I c…

a619850

…ould use TypeScript

pyropy requested changes May 4, 2022

View reviewed changes

Gavin Harris and others added 6 commits August 24, 2022 18:58

wsdfg

f6e276c

sdfds

2cc72b2

sdfds

f39848c

Validate Stake Address validation

daebc6a

Update package.json

3e68824

Fix up the version

Validate Stake Address validation

f613fcc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added address Verification #1

Added address Verification #1

gavinharris-dev commented Nov 30, 2021

gavinharris-dev commented Nov 30, 2021

pyropy commented Dec 1, 2021 •

edited

Loading

pyropy commented Jan 21, 2022

gavinharris-dev commented Jan 22, 2022

pyropy commented Jan 24, 2022

gavinharris-dev commented Feb 9, 2022

pyropy commented Feb 9, 2022

pyropy commented Mar 16, 2022

chrizcros commented Apr 7, 2022

gavinharris-dev commented Apr 18, 2022

bitlands commented Apr 18, 2022

gavinharris-dev commented Apr 18, 2022 •

edited

Loading

bitlands commented Apr 22, 2022

pyropy commented May 4, 2022

chrizcros commented May 4, 2022

pyropy left a comment

pyropy May 4, 2022

pyropy May 4, 2022

pyropy May 4, 2022

pyropy May 4, 2022

chrizcros May 4, 2022

chrizcros commented May 4, 2022

pyropy commented May 4, 2022


		type Signer = (msg: string) => PromiseLike<COSESign1>;

		export function sign(

Added address Verification #1

Are you sure you want to change the base?

Added address Verification #1

Conversation

gavinharris-dev commented Nov 30, 2021

gavinharris-dev commented Nov 30, 2021

pyropy commented Dec 1, 2021 • edited Loading

pyropy commented Jan 21, 2022

gavinharris-dev commented Jan 22, 2022

pyropy commented Jan 24, 2022

gavinharris-dev commented Feb 9, 2022

pyropy commented Feb 9, 2022

pyropy commented Mar 16, 2022

chrizcros commented Apr 7, 2022

gavinharris-dev commented Apr 18, 2022

bitlands commented Apr 18, 2022

gavinharris-dev commented Apr 18, 2022 • edited Loading

bitlands commented Apr 22, 2022

pyropy commented May 4, 2022

chrizcros commented May 4, 2022

pyropy left a comment

Choose a reason for hiding this comment

pyropy May 4, 2022

Choose a reason for hiding this comment

pyropy May 4, 2022

Choose a reason for hiding this comment

pyropy May 4, 2022

Choose a reason for hiding this comment

pyropy May 4, 2022

Choose a reason for hiding this comment

chrizcros May 4, 2022

Choose a reason for hiding this comment

chrizcros commented May 4, 2022

pyropy commented May 4, 2022

pyropy commented Dec 1, 2021 •

edited

Loading

gavinharris-dev commented Apr 18, 2022 •

edited

Loading