How to verify signatures received from provider.signMessage on the backend

[0xkrotus]

[dfstio]

I use the following code that can be adapted for backend:

export async function verifyLoopSignature(
  message: string,
  signatureHex: string
): Promise<boolean> {
  const publicKeyHex = getLoopPublicKey();
  if (!publicKeyHex) {
    console.log("[loop.ts] No public key available for verification");
    return false;
  }

  let sigHex = signatureHex;
  try {
    const parsed = JSON.parse(signatureHex);
    if (parsed.signature) {
      sigHex = parsed.signature;
    }
  } catch {
    // Not JSON, use as-is
  }

  try {
    const publicKey = await crypto.subtle.importKey(
      "raw",
      hexToBytes(publicKeyHex),
      { name: "Ed25519" },
      false,
      ["verify"]
    );

    const isValid = await crypto.subtle.verify(
      "Ed25519",
      publicKey,
      hexToBytes(sigHex),
      new TextEncoder().encode(message)
    );

    console.log("[loop.ts] Signature verification result:", isValid);
    return isValid;
  } catch (error) {
    console.error("[loop.ts] Signature verification error:", error);
    return false;
  }
}

export function getLoopPublicKey(): string | null {
  return getProvider()?.public_key ?? null;
}

[mananbordia]

getLoopPublicKey

From this how do we verify that the signature was from a specific Party ?
Is there some mapping between LoopPublic key and PartyId ?

Sharing expected simple flow here for better understanding:

1. User signs a message and the signer is Party - xyz::1234
2. Now backend will take this message and try to verify that this message from from Party - xyz::1234 only.

How can that be done ?
Thanks

[dfstio]

How can that be done ?

/**
 * Verifies that a partyId's namespace is cryptographically derived from the public key.
 *
 * Canton Party ID format: identifier::1220fingerprint
 * Where fingerprint = SHA256(0x0000000C || public_key_bytes)
 * The 1220 prefix is multihash encoding (0x12=SHA-256, 0x20=32 bytes)
 */
export async function verifyPartyIdMatchesPublicKey(
  partyId: string,
  publicKeyHex: string
): Promise<boolean> {
  try {
    // Parse partyId: identifier::1220fingerprint
    const parts = partyId.split("::");
    if (parts.length !== 2) {
      console.log("[loop.ts] Invalid partyId format - expected identifier::namespace");
      return false;
    }

    const namespace = parts[1];

    // Namespace should start with 1220 (multihash prefix for SHA-256)
    if (!namespace.startsWith("1220")) {
      console.log("[loop.ts] Invalid namespace format - expected 1220 prefix");
      return false;
    }

    const expectedFingerprint = namespace.slice(4); // Remove 1220 prefix

    // Compute fingerprint: SHA256(purpose_id_4bytes || public_key_bytes)
    // HashPurpose.PublicKeyFingerprint = 12 (decimal) = 0x0000000C (4 bytes big-endian)
    const purposeBuffer = new ArrayBuffer(4);
    const purposeBytes = new Uint8Array(purposeBuffer);
    purposeBytes.set([0x00, 0x00, 0x00, 0x0c]);
    const publicKeyBytes = hexToBytes(publicKeyHex);

    // Concatenate purpose + public key
    const inputBuffer = new ArrayBuffer(purposeBytes.length + publicKeyBytes.length);
    const input = new Uint8Array(inputBuffer);
    input.set(purposeBytes, 0);
    input.set(publicKeyBytes, purposeBytes.length);

    // Compute SHA-256
    const hashBuffer = await crypto.subtle.digest("SHA-256", input);
    const hashArray = new Uint8Array(hashBuffer);
    const computedFingerprint = Array.from(hashArray)
      .map(b => b.toString(16).padStart(2, "0"))
      .join("");

    const isValid = computedFingerprint === expectedFingerprint;
    console.log("[loop.ts] PartyId verification:", {
      expected: expectedFingerprint,
      computed: computedFingerprint,
      isValid
    });

    return isValid;
  } catch (error) {
    console.error("[loop.ts] PartyId verification error:", error);
    return false;
  }
}

// Helper function to convert hex string to bytes
function hexToBytes(hex: string): Uint8Array<ArrayBuffer> {
  const buffer = new ArrayBuffer(hex.length / 2);
  const bytes = new Uint8Array(buffer);
  for (let i = 0; i < hex.length; i += 2) {
    bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
  }
  return bytes;
}

[v9n]

Hi @dfstio and @0xkrotus @mananbordia

Thank you for chiming in and help answer. We missted this, and will include this example.

Generally the process is as @dfstio lay out. You need 3 things

• public key
• a challenge
• the signature

Depend on language or library there will be similar function.

We will document this process soon in the docs