Awarded once after a correct answer.
Know what a hash or signature can establish
Useful first : What is a blockchain?
Find your bearings · Step 2 / 6
The site says “sign in”. The wallet says “approve”.
You only want to read an article. A fictional site opens the following wallet request. What would you do?
- Network
- Ethereum
- Token
- EXAMPLE · fictional ERC-20
- Spender
- Unverified contract
- Allowance
- 1 000 EXAMPLE
An ERC-20 approval gives a spender permission up to an allowance. It is different from signing a plain login message. This screen never connects to a wallet.
A fingerprint, a secret and a signature
A cryptographic hash maps data to a fixed-length fingerprint. The same input produces the same output; even a small change produces a different-looking result. Suitable hash functions make finding a matching input or two colliding inputs computationally impractical.
What the wallet actually signs
Hashing is not encryption. Encryption conceals a message until it is decrypted; a hash helps check integrity. Matching a fingerprint establishes consistency with particular data, not that the underlying statement is true. Hashing a false invoice does not make it genuine.
A valid signature is not a safety check
A private key authorises a signature on a specific message. Its public key permits verification without revealing that secret. A wallet manages keys or signing arrangements; coins are recorded on the network. A valid signature can still authorise a harmful action if the signer misunderstood the destination or permissions.
The message matters as much as the key
A private key is used to produce signatures; the corresponding public key lets others verify them. Verification binds a signature to a particular message. The message must also specify its intended context, such as the network and contract: otherwise an authorization may be accepted somewhere it was not intended. Replay protection is an application rule, often involving a nonce; readable formatting alone does not provide it. A wallet can request a transfer, a contract call or a structured message. Read that request, not just the description on the website.
Recovery, secrecy and predictable data
A recovery phrase can derive many keys. It is not a password that customer support can reset. A hash is not encryption: there is normally no decryption key that recovers the input. For predictable inputs, an attacker can try guesses and compare hashes. Hashing a phone number therefore does not automatically make it anonymous. A verified signature also says nothing about whether the key was stolen or whether its owner understood the request.
Follow a message from signing to verification
- 01Message + context
- 02Private-key signature
- 03Public-key verification
- 04Authorization, not truth
Read these as connected concepts, not necessarily consecutive steps.
Read the explanation
A private key is used to produce signatures; the corresponding public key lets others verify them. Verification binds a signature to a particular message. The message must also specify its intended context, such as the network and contract: otherwise an authorization may be accepted somewhere it was not intended. Replay protection is an application rule, often involving a nonce; readable formatting alone does not provide it. A wallet can request a transfer, a contract call or a structured message. Read that request, not just the description on the website.
Put the mechanism into context
In this fictional direct transfer, the signed message includes the network, recipient and amount: “send 25 units to Bob”. After signing, someone changes the recipient to Carol but keeps the amount and signature. Compare the original message with the changed message before deciding whether verification can succeed.
Apply it in the workshop →What this mechanism does not guarantee
A recovery phrase can derive many keys. It is not a password that customer support can reset. A hash is not encryption: there is normally no decryption key that recovers the input. For predictable inputs, an attacker can try guesses and compare hashes. Hashing a phone number therefore does not automatically make it anonymous. A verified signature also says nothing about whether the key was stolen or whether its owner understood the request.
The distinction that changes the analysis
Two identical fingerprints establish a match with a reference. If the reference itself came from the attacker, that match is not evidence of the publisher’s identity. The useful question is therefore both “does it match?” and “who authenticated the reference?”.
Explain it yourself
Revisit the case above. Name what is established, what remains to be checked and the evidence needed to conclude. A strong answer addresses both sides of the diagram.
What happens if the recipient changes?
In this fictional direct transfer, the signed message includes the network, recipient and amount: “send 25 units to Bob”. After signing, someone changes the recipient to Carol but keeps the amount and signature. Compare the original message with the changed message before deciding whether verification can succeed.
No. The recipient was part of the signed message, so changing it changes what is being verified. The original signature does not authorize that new message. This protects the integrity of the request; it does not protect someone who approved the wrong recipient in the first place.
Choose the right check
A supplier sends you a document. To check whether its bytes changed, compare a fresh hash with a reference obtained through a trusted channel. To keep its contents confidential, use encryption with appropriate key management. To check a signature, verify it against the exact document and the expected public key. These are three different jobs.
A fourth question remains: how do you know whose key it is? A valid signature made by an unfamiliar key does not identify your supplier. The link between that key and the supplier must come from a separate trustworthy process. A certificate, a previously verified key or an independently authenticated channel can form part of that process.
For a wallet transaction, apply the same distinction. Check the message and its context, then the signature and transaction rules. The network does not judge whether the payment was sensible or whether the person behind the key understood it.
Check your understanding
The signature verifies for that message and key. Identifying the sender requires a trustworthy link between the key and the claimed identity.
Terms in this lesson
- Hash
- A fixed-length fingerprint computed from data by a hash function. It checks consistency, not truth.
- Private key
- A cryptographic secret used to authorise signatures under a signing scheme.
- Public key
- A value that permits signature verification without revealing the private key.
Prepare a correction note
Describe the passage and the proposed correction. This creates a local note for you to share; it sends nothing. Do not include personal or confidential information.