基于链下链上双视角深入解析以太坊签名与验证

static fromPrivateKey(privateKey: PrivKey) {
    return Point.BASE.multiply(normalizePrivateKey(privateKey));
}

Gx: BigInt('55066263022277343669578718895168534326250603453777594175500187360389116729240')
Gy: BigInt('32670510020758816978083085130507043184471273380659243275938904335757337482424')

var (
	secp256k1N, _  = new(big.Int).SetString("fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141", 16)
	secp256k1halfN = new(big.Int).Div(secp256k1N, big.NewInt(2))
)

func signHash(data []byte) []byte {
   msg := fmt.Sprintf("\x19Ethereum Signed Message:\n%d%s", len(data), data)
   return crypto.Keccak256([]byte(msg))
}

function kmdToSig(kBytes: Uint8Array, m: bigint, d: bigint): RecoveredSig | undefined {
  const k = bytesToNumber(kBytes);
  if (!isWithinCurveOrder(k)) return;
  // Important: all mod() calls in the function must be done over `n`
  const { n } = CURVE;
  const q = Point.BASE.multiply(k);
  // r = x mod n
  const r = mod(q.x, n);
  if (r === _0n) return;
  // s = (1/k * (m + dr) mod n
  const s = mod(invert(k, n) * mod(m + d * r, n), n);
  if (s === _0n) return;
  const sig = new Signature(r, s);
  const recovery = (q.x === sig.r ? 0 : 2) | Number(q.y & _1n);
  return { sig, recovery };
}

static fromSignature(msgHash: Hex, signature: Sig, recovery: number): Point {
    msgHash = ensureBytes(msgHash);
    const h = truncateHash(msgHash);
    const { r, s } = normalizeSignature(signature);
    if (recovery !== 0 && recovery !== 1) {
        throw new Error('Cannot recover signature: invalid recovery bit');
    }
    if (h === _0n) throw new Error('Cannot recover signature: msgHash cannot be 0');
    const prefix = recovery & 1 ? '03' : '02';
    const R = Point.fromHex(prefix + numTo32bStr(r));
    const { n } = CURVE;
    const rinv = invert(r, n);
    // Q = u1⋅G + u2⋅R
    const u1 = mod(-h * rinv, n);
    const u2 = mod(s * rinv, n);
    const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2);
    if (!Q) throw new Error('Cannot recover signature: point at infinify');
    Q.assertValidity();
    return Q;
}

// SignTx signs the transaction using the given signer and private key.
func SignTx(tx *Transaction, s Signer, prv *ecdsa.PrivateKey) (*Transaction, error) {
	h := s.Hash(tx)
	sig, err := crypto.Sign(h[:], prv)
	if err != nil {
		return nil, err
	}
	return tx.WithSignature(s, sig)
}

type Signer interface {
	// Sender returns the sender address of the transaction.
	Sender(tx *Transaction) (common.Address, error)

	// SignatureValues returns the raw R, S, V values corresponding to the
	// given signature.
	SignatureValues(tx *Transaction, sig []byte) (r, s, v *big.Int, err error)
	ChainID() *big.Int

	// Hash returns 'signature hash', i.e. the transaction hash that is signed by the
	// private key. This hash does not uniquely identify the transaction.
	Hash(tx *Transaction) common.Hash

	// Equal returns true if the given signer is the same as the receiver.
	Equal(Signer) bool
}

// MakeSigner returns a Signer based on the given chain config and block number.
func MakeSigner(config *params.ChainConfig, blockNumber *big.Int) Signer {
	var signer Signer
	switch {
	case config.IsLondon(blockNumber):
		signer = NewLondonSigner(config.ChainID)
	case config.IsBerlin(blockNumber):
		signer = NewEIP2930Signer(config.ChainID)
	case config.IsEIP155(blockNumber):
		signer = NewEIP155Signer(config.ChainID)
	case config.IsHomestead(blockNumber):
		signer = HomesteadSigner{}
	default:
		signer = FrontierSigner{}
	}
	return signer
}

func (s londonSigner) Hash(tx *Transaction) common.Hash {
	if tx.Type() != DynamicFeeTxType {
		return s.eip2930Signer.Hash(tx)
	}
	return prefixedRlpHash(
		tx.Type(),
		[]interface{}{
			s.chainId,
			tx.Nonce(),
			tx.GasTipCap(),
			tx.GasFeeCap(),
			tx.Gas(),
			tx.To(),
			tx.Value(),
			tx.Data(),
			tx.AccessList(),
		})
}

const (
	LegacyTxType = iota
	AccessListTxType
	DynamicFeeTxType
)

function recoverSignerFromSignature(uint8 v, bytes32 r, bytes32 s, bytes32 hash) external {
    address signer = ecrecover(hash, v, r, s);
    require(signer != address(0), "ECDSA: invalid signature");
}

struct Mail {
    address from;
    address to;
    string contents;
}

{
  type: 'object',
  properties: {
    types: {
      type: 'object',
      properties: {
        EIP712Domain: {type: 'array'},
      },
      additionalProperties: {
        type: 'array',
        items: {
          type: 'object',
          properties: {
            name: {type: 'string'},
            type: {type: 'string'}
          },
          required: ['name', 'type']
        }
      },
      required: ['EIP712Domain']
    },
    primaryType: {type: 'string'},
    domain: {type: 'object'},
    message: {type: 'object'}
  },
  required: ['types', 'primaryType', 'domain', 'message']
}

{
	domain: {
		// Defining the chain aka Rinkeby testnet or Ethereum Main Net
		chainId: 1,
		// Give a user friendly name to the specific contract you are signing for.
		name: 'Ether Mail',
		// If name isn't enough add verifying contract to make sure you are establishing contracts with the proper entity
		verifyingContract: '0xCcCCccccCCCCcCCCCCCcCcCccCcCCCcCcccccccC',
		// Just let's you know the latest version. Definitely make sure the field name is correct.
		version: '1',
	},

	// Defining the message signing data content.
	message: {
		/*
		- Anything you want. Just a JSON Blob that encodes the data you want to send
		- No required fields
		- This is DApp Specific
		- Be as explicit as possible when building out the message schema.
		*/
		contents: 'Hello, Bob!',
		attachedMoneyInEth: 4.2,
		from: {
		name: 'Cow',
		wallets: [
			'0xCD2a3d9F938E13CD947Ec05AbC7FE734Df8DD826',
			'0xDeaDbeefdEAdbeefdEadbEEFdeadbeEFdEaDbeeF',
		],
		},
		to: [
		{
			name: 'Bob',
			wallets: [
			'0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB',
			'0xB0BdaBea57B0BDABeA57b0bdABEA57b0BDabEa57',
			'0xB0B0b0b0b0b0B000000000000000000000000000',
			],
		},
		],
	},
	// Refers to the keys of the *types* object below.
	primaryType: 'Mail',
	types: {
		// TODO: Clarify if EIP712Domain refers to the domain the contract is hosted on
		EIP712Domain: [
			{ name: 'name', type: 'string' },
			{ name: 'version', type: 'string' },
			{ name: 'chainId', type: 'uint256' },
			{ name: 'verifyingContract', type: 'address' },
		],
		// Not an EIP712Domain definition
		Group: [
			{ name: 'name', type: 'string' },
			{ name: 'members', type: 'Person[]' },
		],
		// Refer to PrimaryType
		Mail: [
			{ name: 'from', type: 'Person' },
			{ name: 'to', type: 'Person[]' },
			{ name: 'contents', type: 'string' },
		],
		// Not an EIP712Domain definition
		Person: [
			{ name: 'name', type: 'string' },
			{ name: 'wallets', type: 'address[]' },
		],
	},
}

struct Person {
	string name;
	address wallet;
}
bytes32 constant PERSON_TYPEHASH = keccak256( 
	"Person(string name,address wallet)"
);
function hash(Person memory person) internal pure returns (bytes32) {
	return keccak256(abi.encode(
		PERSON_TYPEHASH,
		keccak256(bytes(person.name)),
		person.wallet
	));
}

{
	contents: 'Hello, Bob!',
	from: {
		name: 'Cow',
		wallet: '0xCD2a3d9F938E13CD947Ec05AbC7FE734Df8DD826',
	},
	to: {
		name: 'Bob',
		wallet: '0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB',
	}
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;

interface IProduct {
    struct Person {
        string name;
        address wallet;
    }

    struct Mail {
        Person from;
        Person to;
        string contents;
    }

    function verify(Mail memory mail, bytes memory signature) external;
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;

import "openzeppelin-contracts/contracts/utils/cryptography/draft-EIP712.sol";
import "openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol";
import "./IProduct.sol";

contract ProductEIP712 is EIP712, IProduct {
	constructor(string memory _name, string memory _version)
        EIP712(_name, _version)
    {}
}

function _hashTypedDataV4(bytes32 structHash) internal view virtual returns (bytes32) {
	return ECDSA.toTypedDataHash(_domainSeparatorV4(), structHash);
}

function _domainSeparatorV4() internal view returns (bytes32) {
	if (address(this) == _CACHED_THIS && block.chainid == _CACHED_CHAIN_ID) {
		return _CACHED_DOMAIN_SEPARATOR;
	} else {
		return _buildDomainSeparator(_TYPE_HASH, _HASHED_NAME, _HASHED_VERSION);
	}
}

bytes32 constant PERSON_TYPEHASH =
	keccak256("Person(string name,address wallet)");

bytes32 constant MAIL_TYPEHASH =
	keccak256(
		"Mail(Person from,Person to,string contents)Person(string name,address wallet)"
	);
function hash(Person memory person) internal pure returns (bytes32) {
	return
		keccak256(
			abi.encode(
				PERSON_TYPEHASH,
				keccak256(bytes(person.name)),
				person.wallet
			)
		);
}

function hash(Mail memory mail) public pure returns (bytes32) {
	return
		keccak256(
			abi.encode(
				MAIL_TYPEHASH,
				hash(mail.from),
				hash(mail.to),
				keccak256(bytes(mail.contents))
			)
		);
}

function verify(Mail memory mail, bytes memory signature) public {
	bytes32 digest = _hashTypedDataV4(hash(mail));
	address signer = ECDSA.recover(digest, signature);
	require(signer == msg.sender, "Not sender");
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;

import "forge-std/Test.sol";
import "../../src/EIP-712/product.sol";
import "../../src/EIP-712/IProduct.sol";

contract ProductTest is Test {
    ProductEIP712 private product;

    function setUp() public {
        product = new ProductEIP712("Ether Mail", "1");
    }

    function testArg() public {
        vm.chainId(4);
        console2.log(address(product));
    }
}

const msgParams = JSON.stringify({
  domain: {
    name: 'Ether Mail',
	chainId: 4,
	version: '1',
    verifyingContract: '0xce71065d4017f316ec606fe4422e11eb2c47c246',
  },

  message: {
    contents: 'Hello, Bob!',
    from: {
      name: 'Cow',
      wallet: '0xCD2a3d9F938E13CD947Ec05AbC7FE734Df8DD826',
    },
    to: {
        name: 'Bob',
        wallet:
          '0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB',
      },
  },
  primaryType: 'Mail',
  types: {
    EIP712Domain: [
      { name: 'name', type: 'string' },
      { name: 'version', type: 'string' },
      { name: 'chainId', type: 'uint256' },
      { name: 'verifyingContract', type: 'address' },
    ],

    Mail: [
      { name: 'from', type: 'Person' },
      { name: 'to', type: 'Person' },
      { name: 'contents', type: 'string' },
    ],
    Person: [
      { name: 'name', type: 'string' },
      { name: 'wallet', type: 'address' },
    ],
  },
});

const sign = await ethereum.request({
	method: 'eth_signTypedData_v4',
	params: ["0x11475691C2CAA465E19F99c445abB31A4a64955C", msgParams],
});

function testVerify() public {
	vm.chainId(4);
	vm.prank(0x11475691C2CAA465E19F99c445abB31A4a64955C);

	bytes
		memory Signature = hex"70aa843f69e5d32252c65011b34831e79c9c64752134d9318cdefb7f8d7a04ac08a2193aedb8f329a8d80f5390c7f661fe447ccc9337ebed15b578c01d7dc71e1c";
	IProduct.Person memory PersonFrom = IProduct.Person({
		name: "Cow",
		wallet: address(0xCD2a3d9F938E13CD947Ec05AbC7FE734Df8DD826)
	});
	IProduct.Person memory PersonTo = IProduct.Person({
		name: "Bob",
		wallet: address(0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB)
	});
	IProduct.Mail memory mail = IProduct.Mail({
		contents: "Hello, Bob!",
		from: PersonFrom,
		to: PersonTo
	});
	product.verify(mail, Signature);
	vm.stopPrank();
}

function isValidSignature(
	bytes32 _hash,
	bytes calldata _signature
) external override view returns (bytes4) {
	// Validate signatures
	if (recoverSigner(_hash, _signature) == owner) {
		return 0x1626ba7e;
	} else {
		return 0xffffffff;
	}
}

function callERC1271isValidSignature(
	address _addr,
	bytes32 _hash,
	bytes calldata _signature
) external view {
	bytes4 result = IERC1271Wallet(_addr).isValidSignature(_hash, _signature);
	require(result == 0x1626ba7e, "INVALID_SIGNATURE");
}