Search code examples
ethereummetamask

How does Web3-Token verify method really work and is it really secure?

I have read how Web3 Auth works and this picture shows it: enter image description here

It seems that the web3-token.verify method is completely sync and it is a bunch of base64 decode and verify. But hypothetically if I completely re-implement the front end library to mimic the Ethereum API to generate signature with my own public/private key pairs and address. Would I be able to impersonate any address?

Solution

  • As stated in the web3-token package.json, this package implements the EIP-4361 standard (which is currently unfinished in May 2022).

    Its actual signature part uses asymmetric cryptography - signing the message with the signer's private key, and verifying the signature with their public key.

    The only way to impersonate an address is to bypass the verification and treat the signer as 0x123 on the application level even though they are in fact 0x456. But it's not possible to bypass the math behind the cryptography and sign a message for them if you don't know their private key.

    Here's a great article describing the signature mechanics in more depth.