feat(hive): HiveSignMessage — Keychain signBuffer, unblocks dApp login (rc10)#308
Merged
Conversation
…ks dApp login Digest is SHA256(raw message bytes) ONLY — no chain_id prepend, no message prefix (the hive-js Signature.signBuffer contract every Hive dApp verifies against). Output: 65-byte compact recoverable sig (27+recid+4) + the 33-byte compressed pubkey so the host can build Keychain's publicKey response field without a second round-trip. - Full SLIP-48 path shape enforced like the tx handlers; any of the four roles may sign (dApp login uses posting') - Messages beginning with the mainnet chain id are refused: such a buffer would hash to a broadcastable TRANSACTION digest (tx digest = SHA256(chain_id || tx)) - 1024-byte cap in proto AND handler (memo-length lesson) - Printable text shown as-is, other payloads as a hex preview - hive_sign_raw_digest factored out of hive_sign_digest (shared header/recid logic, no duplication) - IDs 1610-1613 skipped: NEAR holds them on device-protocol master - pyk: sign_message + 7 signBuffer tests (recovery, roles, boundary, oversize, path fence, chain-id collision)
…ffer Finding 1: printable text over 128 bytes now routes through the hex preview + byte count instead of confirm()'s silently-truncating body buffer (BODY_CHAR_MAX) — a long message could otherwise show a benign prefix while the device signs hidden trailing content. Same budget as SolanaSignMessage. Finding 2: owner' removed from the accepted signBuffer roles. Keychain's requestSignBuffer surface is Posting | Active | Memo only; no consumer offers owner', and the cold owner key must not be normalized into dApp flows. Also: comment now says printable ASCII (0x20-0x7e), not UTF-8. Pins: device-protocol a793934 (role doc), python-keepkey ed8cbdf (19/19 on emulator incl. new >128B printable boundary + owner' reject).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-targeted to develop for the rc10 merge (original #306 auto-closed when its stacked base branch
fix/hive-sign-hardeningwas deleted on merge of #305). Same content, headcbf33967c(includes the clang-format lint fix). Full review is in #306; stack CI verified green on the combined tip via the mirror branch.