3

I want to create a Python implementation of an lnurl-auth server.

I started a quick HTTP server to be the callback url, and captured the signed callback sent by BLW on Android.

?tag=login
&k1=7c27131e7fb37df50d12b0cb56ac1b76f817a5ba535b15afe43390a1f6b55d4d
&sig=30450221008172a00276a4724909b37051e98b36ba4f465aac82dd4d9609f91a3cd3be1a32022075bffd8d7697d140055b27e67d31a606435fdf5073c9c96d46a02cae06a5abc4&key=030f12794ae14407b8e1bfa1cbc297bb68ce6b24455ceab52c02da7a92782b6b14

Here is some python that attempts to verify that signature.

import secp256k1

k1 = bytes.fromhex("7c27131e7fb37df50d12b0cb56ac1b76f817a5ba535b15afe43390a1f6b55d4d")
key = bytes.fromhex('030f12794ae14407b8e1bfa1cbc297bb68ce6b24455ceab52c02da7a92782b6b14')
sig = bytes.fromhex('30450221008172a00276a4724909b37051e98b36ba4f465aac82dd4d9609f91a3cd3be1a32022075bffd8d7697d140055b27e67d31a606435fdf5073c9c96d46a02cae06a5abc4')


pubkey = secp256k1.PublicKey(key, raw=True)
sig = pubkey.ecdsa_deserialize(sig)
print(pubkey.ecdsa_verify(k1, sig))

Output: False

I don't know enough to tell what I'm doing wrong. It seems like this should be fairly standard use of the secp256k1 library.

0

I gave up using the secp256k1 library, but here is a working python solution:

Make sure to install the python-ecdsa package, for instance with pip:

pip install ecdsa

...and then...

import ecdsa

k1 = bytes.fromhex('b29fa5994dc9da9906a36f996e6ac4faa2b0e2601ef13b0fab9d4b4287c57e1f')
key = bytes.fromhex('030f12794ae14407b8e1bfa1cbc297bb68ce6b24455ceab52c02da7a92782b6b14')
sig = bytes.fromhex('3045022100a23fbcaf3f24aff085d8c86a744764be8390e8511eca675ae2af037f33ff1a92022035f00465fbcad73e3175d7dc2e891322fa9dcce7bbd19409866f855e6da1f51e')

vk = ecdsa.VerifyingKey.from_string(key, curve=ecdsa.SECP256k1)
vk.verify_digest(sig, k1, sigdecode=ecdsa.util.sigdecode_der)

With the ecdsa library, make sure to use verify_digest rather than verify.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.