Documentation of ecrecover

[graup]

It would be nice if the documentation would explain the parameters and maybe give an example on how you would use this function.

http://solidity.readthedocs.io/en/latest/units-and-global-variables.html#mathematical-and-cryptographic-functions

[Denton-L]

For now, take a look at this. Hopefully it'll tide you over until I can properly document this.

[Denton-L]

@VoR0220, do you think this should be explicitly stated in these docs or is a quick link to the web3 docs sufficient?

[chriseth]

It does not hurt to mention it explicitly.

[chriseth]

Also either mention or fix the "invalid input" bug for ecrecover.

[Denton-L]

@chriseth, what is this "invalid input" bug?

[axic]

Perhaps including (a link to) https://gist.github.com/axic/5b33912c6f61ae6fd96d6c4a47afde6d could be useful.

[graup]

I wish the code @axic posted was part of the standard library. Without it ecrecover is pretty useless to the normal developer.

[jackliu8722]

when i use the function ecrecover in solidity, there is something wrong , which i can not get the right result?

[clowdrgn]

There is a wrong answer when I use ecrecover,the address always be different.but when I use personal_ecRecover,it's right. Is there something different between those two method? I have try those method upstair,web3.eth.sign has the same result with personal.sign.but can't pass solidity ecrecover method too.

[danmermel]

Hello, apologies if this is not the correct place to comment on this (and please direct me elsewhere if necessary), but I am having the same issue - following all the examples, including the one linked to from here #2151 , I am unable to get ecrecover to work as documented (i.e. it does not return the signing address). I have posted a more detailed question here https://ethereum.stackexchange.com/questions/15364/totally-baffled-by-ecrecover with details of what I am doing. Can anyone explain what may be wrong?
Thanks!

[chriseth]

I'm not sure how much detail we would like to mention here. We should mention that a return value of zero means "invalid input" and that the ecrecover builtin still has the "high s" issue, i.e. you can take an existing signature and modify both v and s (IIRC) in a certain way, to get a different but equally valid signature.

[ChrisChinchilla]

@chriseth I'm also not very sure of the level of detail here. I can find a lot of questions, but I'm also not sure how many still apply. e.g.

https://ethereum.stackexchange.com/questions/15364/ecrecover-from-geth-and-web3-eth-sign

Also because we bump into the issue of Solidity being part of a toolchain again, most of the examples to show how to use ecrecover properly use something else alongside, I can do that if you think it's a good idea?

@gumb0 had no recollection of the "high s" issue still existing, and neither of us can find any reference to it either.

[chriseth]

"high s" still not documented.

[ChrisChinchilla]

@chriseth My comment from the last time we spoke about this remains. There are no search results for "high s", and no one else I spoke to at EF knew what was meant by it. So I am happy to document, but need a little guidance.

[chriseth]

Openzeppelin are about to fix it in the helper library: OpenZeppelin/openzeppelin-contracts#1622

We should say something along the lines of "if you use the low-level ecrecover function, be aware that a valid signature can be turned into a different valid signature without requiring knowledge of the corresponding private key. This is usually not a problem unless if you require signatures to be unique or use them to identify items."

[ChrisChinchilla]

Does this help @leonardoalt and @chriseth ?

And I wonder if we should hold off on merging until that OZ PR is merged? As I'm not sure this doc is true until that point?

[cdetrio]

(copying from a comment on the PR): the "high s" problem, and why the ecrecover precompile behavior was left unchanged when high s became invalid for transactions, is discussed in the Homestead EIP http://eips.ethereum.org/EIPS/eip-2.