hyperledger / hyperledger/fabric-gateway

Wrong ed25519 signature due to signing identity's hash function

Open
#757 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
194
Forks
110
Avg merge
18h 46m
Merged PRs (30d)
42

Description

Following up with my [pull request](https://github.com/hyperledger/fabric/pull/3343) that implemented the support for ed25519 keys in fabric, I had trouble with signing transactions with such keys.

I believe the problem comes from [./pkg/client/transactions.go](https://github.com/hyperledger/fabric-gateway/blob/050e807a075d31e3abc8ba40a8455e5ef21fbcc6/pkg/client/transaction.go#L112-L113) and [./pkg/client/signingidentity.go](https://github.com/johannww/fabric-gateway/blob/198bae79607dcdd87ec47349233dbbc88d7d74d1/pkg/client/signingidentity.go#L24-L32):

```go
digest := transaction.Digest()
signature, err := transaction.signingID.Sign(digest)
```

and

```go
func newSigningIdentity(id identity.Identity) *signingIdentity {
return &signingIdentity{
id: id,
sign: func(digest []byte) ([]byte, error) {
return nil, errors.New("no sign implementation supplied")
},
hash: hash.SHA256,
}
}
```

In Go, ed25519 sign functions receive the message as parameter, not the digest.

PS: I realized that it is possible to pass the function hash.NONE to the gateway, and it solved my problem. However, I still think that the gateway should handle this internally, but I wait on your further analysis.

```go
gateway, err := gatewayClient.Connect(
// ...
gatewayClient.WithHash(hash.NONE),
)
```

I would suggest the following changes to **./client/signingidentity.go**:

```go
func newSigningIdentity(id identity.Identity) *signingIdentity {
hashAlg := hash.SHA256
cert, err := identity.CertificateFromPEM([]byte(id.Credentials()))

if err == nil && cert.PublicKeyAlgorithm == x509.Ed25519 {
hashAlg = hash.NONE
}

return &signingIdentity{
id: id,
sign: func(digest []byte) ([]byte, error) {
return nil, errors.New("no sign implementation supplied")
},
hash: hashAlg,
}
}
```

- Steps to reproduce.
- Setup a Fabric v3.0.0
- Give ed25519 keys to users, orgs, peers
- Enable the following channel capabilities:
- For channel, V3_0: true
- For orderer, V2_0: true
- For application, V2_5: true
- Install a chaincode on the network
- Perform an EvaluateTransaction
- Expected behavior.
- The transaction should be successful
- Programming language and version.
- Go 1.23.1
- Client API version used.
- fabric-gateway v1.6.0
- Fabric version used.
- v3.0.0

Contributor guide

Open the contributing guide

Research direction

Start by reading pkg/client/transactions.go and pkg/client/signingidentity.go, focusing on how the transaction digest is passed to the signing identity and how the hash algorithm is selected. Compare the ed25519 path with the existing hash.NONE configuration, then reproduce the EvaluateTransaction flow; done means ed25519-backed transactions sign successfully without requiring callers to override the hash.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, blockchain, cryptography, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.