<p>To start with, Message Signing in Cardano follows CIP-0008 <a href="https://github.com/cardano-foundation/CIPs/tree/master/CIP-0008" rel="nofollow noreferrer">https://github.com/cardano-foundation/CIPs/tree/master/CIP-0008</a></p>
<p>Reading this would give a more idea around message signing.</p>
<p>Answer to your question, How to verify this signature,</p>
<p>From the CBOR you have pasted, This CBOR is CIP-0008 followed COSE_SIGN1 structure, and most probably created from Nami Wallet.</p>
<p>Further decoding first array item from decoded CBOR, you can see the following Map,</p>
<pre><code>{1: -8, &quot;address&quot;: h'00E922E8166852073D6C1C9BE0736530404C9C26D9BA1773E11D32D11C0F7B2C7F8924528D797A8F86D8210D6276E09F47B82ECD53A24900E7'}
</code></pre>
<p>This contains <code>address</code> as one property, This map is also supposed to contain one more attribute <code>4</code> with publicKey of corresponding privateKey that signed the message unfortunately is missing.</p>
<p>So if you have public key in that, You can follow CIP-0008 to verify the message, but as it is missing, only option you have is to ask publicKey from whom you received this message, if you got this CBOR from Nami Wallet then you might have got publicKey as well.</p>
<p>More details on how to verify this CBOR can be found in CIP-0008.</p>
<p><strong>Updates</strong></p>
<p>You can also use <a href="https://www.npmjs.com/package/@stricahq/cip08" rel="nofollow noreferrer">@stricahq/cip08</a> javascript library to to create/verify signature.</p>
<pre><code>import { CoseSign1 } from &quot;@stricahq/cip08&quot;;

const messageCBOR = &quot;&lt;message cbor received from wallet&gt;&quot;;
const builder = CoseSign1.fromCbor(messageCBOR);

// If message cbor contains publicKey, it will try to verify the
// signature and return true/false
const verified = builder.verifySignature();

// if you want publicKey and address
const publicKeyBuffer = builder.getPublicKey();
const addressBuffer = builder.getAddress();
</code></pre>

CC BY-SA 4.0
2022-03-28T16:06:10.867Z
Thanks for the clarification! I do believe Nami wallet sends the public key in the headers, but I believe Eternl wallet still doesn't :(
glneto
CC BY-SA 4.0
2022-03-26T16:27:48.810Z
2022-04-17T03:27:14.753Z
2022-04-17T03:27:14.753Z
Mehul Prajapati
<p>I'm having some trouble to understand how am I supposed to verify if a signed data was really signed by a specific address.</p>
<p>Checking this CBOR</p>
<pre><code>845846A201276761646472657373583900E922E8166852073D6C1C9BE0736530404C9C26D9BA1773E11D32D11C0F7B2C7F8924528D797A8F86D8210D6276E09F47B82ECD53A24900E7A166686173686564F44B68656C6C6F20776F726C645840D1FCCD8B340A46FD9573FE6A0F6BFC8373562019E9FCD8BDFD7A7D08A89FE98BF28E6736BAE823C024C7B20081C6D30FC4676D2A314299F22CB0264EE7E6AB04
</code></pre>
<p>That I got from signing a &quot;hello world&quot; message payload:</p>
<pre><code>[h'A201276761646472657373583900E922E8166852073D6C1C9BE0736530404C9C26D9BA1773E11D32D11C0F7B2C7F8924528D797A8F86D8210D6276E09F47B82ECD53A24900E7', {&quot;hashed&quot;: false}, h'68656C6C6F20776F726C64', h'D1FCCD8B340A46FD9573FE6A0F6BFC8373562019E9FCD8BDFD7A7D08A89FE98BF28E6736BAE823C024C7B20081C6D30FC4676D2A314299F22CB0264EE7E6AB04']
</code></pre>
<p>I see that I have the address in the headers and I also have the ed25519 signature, but I'm not sure how am I supposed to determine the public key for this and I obviously don't have access to the secret at that point. I was trying something like:</p>
<pre><code>import { eddsa } from &quot;elliptic&quot;;

const EdDSA = new eddsa(&quot;ed25519&quot;);

const key = EdDSA.keyFromPublic(
    ? // what do I put here? Is there a way I can get the public key from the address hex?
);

const verifies = key.verify(
  &quot;hello world&quot;,
  &quot;D1FCCD8B340A46FD9573FE6A0F6BFC8373562019E9FCD8BDFD7A7D08A89FE98BF28E6736BAE823C024C7B20081C6D30FC4676D2A314299F22CB0264EE7E6AB04&quot;
);

console.log(&quot;Valid:&quot;, verifies);
</code></pre>
<p>Thanks in advance for your time!</p>

<public-key><private-key><eddsa><message-signing>
How to verify signed data?
# How to verify signed data?

(Asked by: username_0 on 2022-03-25)

I'm having some trouble to understand how am I supposed to verify if a signed data was really signed by a specific address.
Checking this CBOR
845846A201276761646472657373583900E922E8166852073D6C1C9BE0736530404C9C26D9BA1773E11D32D11C0F7B2C7F8924528D797A8F86D8210D6276E09F47B82ECD53A24900E7A166686173686564F44B68656C6C6F20776F726C645840D1FCCD8B340A46FD9573FE6A0F6BFC8373562019E9FCD8BDFD7A7D08A89FE98BF28E6736BAE823C024C7B20081C6D30FC4676D2A314299F22CB0264EE7E6AB04

That I got from signing a "hello world" message payload:
[h'A201276761646472657373583900E922E8166852073D6C1C9BE0736530404C9C26D9BA1773E11D32D11C0F7B2C7F8924528D797A8F86D8210D6276E09F47B82ECD53A24900E7', {"hashed": false}, h'68656C6C6F20776F726C64', h'D1FCCD8B340A46FD9573FE6A0F6BFC8373562019E9FCD8BDFD7A7D08A89FE98BF28E6736BAE823C024C7B20081C6D30FC4676D2A314299F22CB0264EE7E6AB04']

I see that I have the address in the headers and I also have the ed25519 signature, but I'm not sure how am I supposed to determine the public key for this and I obviously don't have access to the secret at that point. I was trying something like:
import { eddsa } from "elliptic";

const EdDSA = new eddsa("ed25519");

const key = EdDSA.keyFromPublic(
    ? // what do I put here? Is there a way I can get the public key from the address hex?
);

const verifies = key.verify(
  "hello world",
  "D1FCCD8B340A46FD9573FE6A0F6BFC8373562019E9FCD8BDFD7A7D08A89FE98BF28E6736BAE823C024C7B20081C6D30FC4676D2A314299F22CB0264EE7E6AB04"
);

console.log("Valid:", verifies);

Thanks in advance for your time!

**Tags:** public-key, private-key, eddsa, message-signing

---

## 1 answers

### Answer by username_1 on 2022-03-26. Score: 3 | Accepted answer

To start with, Message Signing in Cardano follows CIP-0008 https://github.com/cardano-foundation/CIPs/tree/master/CIP-0008
Reading this would give a more idea around message signing.
Answer to your question, How to verify this signature,
From the CBOR you have pasted, This CBOR is CIP-0008 followed COSE_SIGN1 structure, and most probably created from Nami Wallet.
Further decoding first array item from decoded CBOR, you can see the following Map,
{1: -8, "address": h'00E922E8166852073D6C1C9BE0736530404C9C26D9BA1773E11D32D11C0F7B2C7F8924528D797A8F86D8210D6276E09F47B82ECD53A24900E7'}

This contains address as one property, This map is also supposed to contain one more attribute 4 with publicKey of corresponding privateKey that signed the message unfortunately is missing.
So if you have public key in that, You can follow CIP-0008 to verify the message, but as it is missing, only option you have is to ask publicKey from whom you received this message, if you got this CBOR from Nami Wallet then you might have got publicKey as well.
More details on how to verify this CBOR can be found in CIP-0008.
Updates
You can also use @stricahq/cip08 javascript library to to create/verify signature.
import { CoseSign1 } from "@stricahq/cip08";

const messageCBOR = "";
const builder = CoseSign1.fromCbor(messageCBOR);

// If message cbor contains publicKey, it will try to verify the
// signature and return true/false
const verified = builder.verifySignature();

// if you want publicKey and address
const publicKeyBuffer = builder.getPublicKey();
const addressBuffer = builder.getAddress();

> **Comments:**
> **username_0**: Thanks for the clarification! I do believe Nami wallet sends the public key in the headers, but I believe Eternl wallet still doesn't :(  

---

