Signature
A cryptographic signature proves that the holder of a private key authorized specific data without revealing the private key itself.
✦ Key Insight
Signing is how users authorize transfers, swaps, logins, permits, and other actions. A malicious signature request can sometimes grant permissions or enable later actions, so users should understand what they are signing instead of treating every signature as harmless.
✕ Common Misconceptions
"Sign message" does not always mean "no risk." Some signed messages can authorize token permits, orders, or other actions. Check the domain, chain, spender, amounts, expiration, and readable details before signing.
Detailed Explanation
Aliases and acronyms: Digital signature; cryptographic signature; wallet signature; transaction signature
Plain-English explanation: Wallets use digital signatures to authorize blockchain transactions and messages. The signature is mathematically linked to the signed data and the signer's key. Networks or applications can verify it using the corresponding public address or key information.
Analogy: It is like a tamper-evident personal seal that can be verified by others but cannot be recreated without your private signing key.
How it works: A wallet hashes or structures the data to be signed and uses the private key to create a cryptographic signature. Verifiers check the signature against the expected signer and message. Standards such as EIP-712 make typed structured-data signatures more readable and consistent for applications.
FAQs
Q: Does signing reveal my private key?
A: No. A properly generated digital signature allows verification without exposing the private key.
Q: Is signing a message the same as sending a transaction?
A: No. A message signature may be off-chain and cost no gas, while a transaction is submitted for on-chain execution. However, signed messages can still authorize important actions.
Q: Can a signature be reused?
A: That depends on the signed data and application design. Nonces, chain identifiers, domains, and expirations are commonly used to prevent unintended replay.
Sources
In Practice
Dig Deeper
Secret Recovery Phrase
A secret recovery phrase (also called seed phrase or mnemonic) is a human-readable sequence of 12 or 24 words generated by a wallet that encodes the master seed from which all private keys and addresses are deterministically derived.
Approval / Allowance
An ERC-20 approval sets an allowance that lets a specified address or smart contract spend up to a defined amount of a user's tokens.
Transaction
A transaction is an action submitted to a blockchain that changes or records blockchain state. Transactions can transfer cryptocurrency, swap tokens, interact with smart contracts, stake assets, vote, mint tokens, or perform other network operations.