cardano-foundation/cip30-data-signature-parser

Java implementation of CIP-30 DataSignature parsing and validation

Java CIP-30 Data Signature Parser and Validator

Introduction

Implementation in Java of CIP-30 Data Signature Parser and Validator (https://github.com/cardano-foundation/CIPs/tree/master/CIP-0030). This library is useful in situation where your project is JVM based and you need to parse / validate CIP-30 data signature and extract information encoded in it.

Features

In particular this library allows you to get / validate:

• validate CIP-30 data signed envelop (DataSignature) using either embedded public key or explicitly supplied key (CIP-30 data signature should contain public key)
• get message from the data signature envelope
• get stored Cardano address
• get ED 25519 public key and ED 25519 signature encoded in it
• get COSE payload (COSE wrapped message directly signed by the algorithm)
• library makes it easy to extract (ED 25519 public key and ED 25519 signature as well as COSE payload)

Additional Docs

• CODE_OF_CONDUCT.md
• SECURITY.md
• CONTRIBUTING.md
• CHANGELOG.md
• GLOSSARY.md

Requirements

Java 17 LTS or greater

Building

git clone https://github.com/cardano-foundation/cip30-data-signature-parser
cd cip30-data-signature-parser
mvn clean package

Dependency

<dependency>
    <groupId>org.cardanofoundation</groupId>
    <artifactId>cip30-data-signature-parser</artifactId>
    <version>0.0.11</version>
</dependency>

Example Usage

var sig = "84582aa201276761646472657373581de1b83abf370a14870fdfd6ccb35f8b3e62a68e465ed1e096c5a6f5b9d6a166686173686564f4565468697320697320612074657374206d657373616765584042e2bfc4e1929769a0501b884f66794ae3485860f42c01b70fac37f75e40af074c6b2a61b04c6cf8a493c0dced1455b4f1129dbf653ad9801c52ce49ff6d5a0e";
var key = "a40101032720062158202f1867873147cf53c442435723c17e83beeb8e2153851cd73ccfb1b5e68994a4";

var verifier = new CIP30Verifier(sig, key);

var verificationResult = verifier.verify();

System.out.println("is valid?: " + verificationResult.isValid());

System.out.println("Optional address(bech32): " + verificationResult.getAddress(AddressFormat.TEXT).orElseThrow());

System.out.println("Message: " + result.getMessage(TEXT));

produces

is valid?: true
Optional address(bech32): stake1uxur40ehpg2gwr7l6mxtxhut8e32drjxtmg7p9k95m6mn4s0tdy6k
Message: This is a test message

Caveats / Notes

• parser is strict, meaning it won't be possible to extract / get various fields if a CIP-30 signature is invalid, alternatively one can develop one with lenient parsing.

cip30-data-signature-parser's Issues

Unit Tests: check if parsing / validation is supported when CIP-8 message is nil

Issue:
It is not so easy to encode messages with nil using wallets, we have to find a library where we can sign CIP-8 signature with nil and put into our unit tests to make sure it is fine. (spoiler alert: it should be fine but it would be nice to have a test case for it).

Instead of using wallets we can use a low level library in rust to actually generate such a signature with a null payload and add this to the test case.

https://github.com/Emurgo/message-signing/blob/master/examples/rust/src/main.rs

Add support to be able to validate / parse CIP-8 signatures using only passwords

Is actually anybody using password based CIP-8 message signing?

Add support for validating / parsing signatures signed with more than one key

Unit Tests: write unit test with Byron era / Ikarus address serialised and check if parser / validator works correctly

Unit Tests: serialise random UTF-8 characters and check if CIP-30 parser correctly deserialises them