feat(identity): add secp256k1 identity type and EIP-712 endorsement envelope - #1685
Closed
Rama542 wants to merge 2 commits into
Closed
feat(identity): add secp256k1 identity type and EIP-712 endorsement envelope#1685Rama542 wants to merge 2 commits into
Rama542 wants to merge 2 commits into
Conversation
…nvelope
Adds the foundational secp256k1 identity primitives needed by the
Ethereum/EVM driver. Ethereum accounts are identified by a 20-byte
address derived from a secp256k1 public key, and off-chain co-signers
approve token operations by signing an EIP-712 typed-data digest.
Changes:
- token/driver/wallet.go: register Secp256k1IdentityType (= 7) and
Secp256k1IdentityTypeString ("secp256k1") alongside the existing
identity type constants so the rest of the SDK can reference the
new type without importing the eth package.
- token/services/identity/typed.go: extend TypeToString to return
the correct label for Secp256k1IdentityType.
- token/services/identity/eth/signer.go: Signer wraps a secp256k1
private key. Sign keccak256-hashes the message then returns a
DER-encoded ECDSA signature, matching the Ethereum eth_sign and
EIP-712 conventions.
- token/services/identity/eth/verifier.go: Verifier wraps a
secp256k1 public key. Verify parses the DER signature,
keccak256-hashes the message, and checks the result.
AddressFromPublicKey derives the standard 20-byte Ethereum address
from the public key (keccak256 of X||Y bytes, last 20 bytes).
- token/services/identity/eth/eip712.go: Domain and
EndorsementRequest typed-data structs plus HashEndorsementRequest,
which computes the full EIP-712 digest
keccak256(0x1901 || domainSeparator || structHash). Uses the
pre-standardisation Keccak-256 variant that Ethereum adopted, via
golang.org/x/crypto/sha3.NewLegacyKeccak256 (already a direct
dependency). secp256k1 signing is provided by
github.com/decred/dcrd/dcrec/secp256k1/v4 (already an indirect
dependency), so no new modules are introduced.
- token/services/identity/eth/eth_test.go: 14 unit tests covering
sign/verify round-trip, wrong-message and wrong-key rejection, nil
key error paths, malformed signature rejection, address derivation
properties, EIP-712 hash determinism and field sensitivity, and a
full end-to-end endorse-and-verify flow.
Closes LFDT-Panurus#1667
Signed-off-by: Rama542 <ramasasankgudipati@gmail.com>
Signed-off-by: Rama542 <Rama542@users.noreply.github.com>
Signed-off-by: Rama542 <ramasasankgudipati@gmail.com> Signed-off-by: Rama542 <Rama542@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1667
This PR adds the secp256k1 identity primitives needed by the Ethereum/EVM driver. Ethereum accounts are 20-byte addresses derived from secp256k1 public keys, and co-signers approve token operations off-chain by signing EIP-712 typed-data digests before the transaction is submitted to the ledger.
What changed:
A new package token/services/identity/eth is introduced with three source files:
signer.go wraps a secp256k1 private key. Sign keccak256-hashes the caller-supplied message and returns a DER-encoded ECDSA signature, which matches the Ethereum signing convention used by eth_sign and EIP-712.
verifier.go wraps a secp256k1 public key. Verify parses the DER signature, keccak256-hashes the message, and checks the result against the stored key. AddressFromPublicKey derives the standard 20-byte Ethereum address from any secp256k1 public key (keccak256 of the uncompressed key X||Y bytes, taking the last 20 bytes of the hash).
eip712.go defines the Domain and EndorsementRequest typed-data structs and HashEndorsementRequest, which builds the full EIP-712 digest: keccak256(0x1901 || domainSeparator || structHash). The domain separator and struct hash follow the EIP-712 spec exactly, with string fields hashed via keccak256 and uint64 fields ABI-encoded as 32-byte big-endian values.
Two existing files are also updated:
token/driver/wallet.go registers Secp256k1IdentityType (= 7) and Secp256k1IdentityTypeString ("secp256k1") alongside the existing identity type constants.
token/services/identity/typed.go extends TypeToString to return the correct label for the new type.
No new module dependencies are introduced. Keccak-256 is provided by golang.org/x/crypto/sha3 (already a direct dependency) and secp256k1 signing by github.com/decred/dcrd/dcrec/secp256k1/v4 (already an indirect dependency).
Testing:
eth_test.go contains 14 unit tests:
All 14 tests pass.