diff --git a/core/auth.go b/core/auth.go index 8937f3690..7e7669aa2 100644 --- a/core/auth.go +++ b/core/auth.go @@ -1,10 +1,12 @@ package core import ( + "bytes" "errors" "fmt" geth "github.com/ethereum/go-ethereum/common" + "github.com/ethereum/go-ethereum/common/hexutil" "github.com/ethereum/go-ethereum/crypto" ) @@ -23,14 +25,24 @@ func VerifySignature(message []byte, accountAddr geth.Address, sig []byte) error return fmt.Errorf("signature length is unexpected: %d", len(sig)) } + publicKeyBytes, err := hexutil.Decode(accountAddr.Hex()) + if err != nil { + return fmt.Errorf("failed to decode public key (%v): %v", accountAddr.Hex(), err) + } + + // Decode public key + pubKey, err := crypto.UnmarshalPubkey(publicKeyBytes) + if err != nil { + return fmt.Errorf("failed to decode public key (%v): %v", accountAddr.Hex(), err) + } + // Verify the signature sigPublicKeyECDSA, err := crypto.SigToPub(message, sig) if err != nil { return fmt.Errorf("failed to recover public key from signature: %v", err) } - pubKey := crypto.PubkeyToAddress(*sigPublicKeyECDSA).Hex() - if pubKey != accountAddr.Hex() { + if !bytes.Equal(pubKey.X.Bytes(), sigPublicKeyECDSA.X.Bytes()) || !bytes.Equal(pubKey.Y.Bytes(), sigPublicKeyECDSA.Y.Bytes()) { return errors.New("signature doesn't match with provided public key") } diff --git a/core/auth/authenticator.go b/core/auth/authenticator.go index 64024f5cb..74fe4bf50 100644 --- a/core/auth/authenticator.go +++ b/core/auth/authenticator.go @@ -1,12 +1,14 @@ package auth import ( + "bytes" "encoding/binary" "errors" "fmt" "github.com/Layr-Labs/eigenda/core" + "github.com/ethereum/go-ethereum/common/hexutil" "github.com/ethereum/go-ethereum/crypto" ) @@ -29,15 +31,25 @@ func (*authenticator) AuthenticateBlobRequest(header core.BlobAuthHeader) error buf := make([]byte, 4) binary.BigEndian.PutUint32(buf, header.Nonce) hash := crypto.Keccak256(buf) + + publicKeyBytes, err := hexutil.Decode(header.AccountID) + if err != nil { + return fmt.Errorf("failed to decode public key (%v): %v", header.AccountID, err) + } + + // Decode public key + pubKey, err := crypto.UnmarshalPubkey(publicKeyBytes) + if err != nil { + return fmt.Errorf("failed to decode public key (%v): %v", header.AccountID, err) + } + // Verify the signature sigPublicKeyECDSA, err := crypto.SigToPub(hash, sig) if err != nil { return fmt.Errorf("failed to recover public key from signature: %v", err) } - pubKey := crypto.PubkeyToAddress(*sigPublicKeyECDSA).Hex() - - if pubKey != header.AccountID { + if !bytes.Equal(pubKey.X.Bytes(), sigPublicKeyECDSA.X.Bytes()) || !bytes.Equal(pubKey.Y.Bytes(), sigPublicKeyECDSA.Y.Bytes()) { return errors.New("signature doesn't match with provided public key") } diff --git a/core/auth/signer.go b/core/auth/signer.go index 019811027..d900a56bf 100644 --- a/core/auth/signer.go +++ b/core/auth/signer.go @@ -8,6 +8,7 @@ import ( "github.com/Layr-Labs/eigenda/core" "github.com/ethereum/go-ethereum/common" + "github.com/ethereum/go-ethereum/common/hexutil" "github.com/ethereum/go-ethereum/crypto" ) @@ -48,8 +49,8 @@ func (s *LocalBlobRequestSigner) SignBlobRequest(header core.BlobAuthHeader) ([] func (s *LocalBlobRequestSigner) GetAccountID() (string, error) { - accountId := crypto.PubkeyToAddress(s.PrivateKey.PublicKey).Hex() - return accountId, nil + publicKeyBytes := crypto.FromECDSAPub(&s.PrivateKey.PublicKey) + return hexutil.Encode(publicKeyBytes), nil } diff --git a/disperser/apiserver/server.go b/disperser/apiserver/server.go index eff6c8ba3..b0163a942 100644 --- a/disperser/apiserver/server.go +++ b/disperser/apiserver/server.go @@ -26,6 +26,8 @@ import ( "github.com/Layr-Labs/eigenda/encoding" "github.com/Layr-Labs/eigenda/encoding/rs" "github.com/Layr-Labs/eigensdk-go/logging" + "github.com/ethereum/go-ethereum/common/hexutil" + "github.com/ethereum/go-ethereum/crypto" grpcprom "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus" "github.com/prometheus/client_golang/prometheus" "google.golang.org/grpc" @@ -136,7 +138,23 @@ func (s *DispersalServer) DisperseBlobAuthenticated(stream pb.Disperser_Disperse return api.NewErrorInvalidArg(err.Error()) } - authenticatedAddress := blob.RequestHeader.BlobAuthHeader.AccountID + // Get the ethereum address associated with the public key. This is just for convenience so we can put addresses instead of public keys in the allowlist. + // Decode public key + publicKeyBytes, err := hexutil.Decode(blob.RequestHeader.AccountID) + if err != nil { + s.metrics.HandleInvalidArgRpcRequest("DisperseBlobAuthenticated") + s.metrics.HandleInvalidArgRequest("DisperseBlobAuthenticated") + return api.NewErrorInvalidArg(fmt.Sprintf("failed to decode account ID (%v): %v", blob.RequestHeader.AccountID, err)) + } + + pubKey, err := crypto.UnmarshalPubkey(publicKeyBytes) + if err != nil { + s.metrics.HandleInvalidArgRpcRequest("DisperseBlobAuthenticated") + s.metrics.HandleInvalidArgRequest("DisperseBlobAuthenticated") + return api.NewErrorInvalidArg(fmt.Sprintf("failed to decode public key (%v): %v", hexutil.Encode(publicKeyBytes), err)) + } + + authenticatedAddress := crypto.PubkeyToAddress(*pubKey).String() // Send back challenge to client challengeBytes := make([]byte, 32)