Signatures
Signatures allow you to track who did what, for every document. In the cruel life out there, anybody can trip you up and deny it was them, or alter the content of your files and blame your dog. In DefraDB, each change is not only logged as a commit block, but also signed with the actor's identity responsible of the database mutation.
Signature object
The signature object is available for every Commit object:
type Signature {
identity: String,
type: String,
value: String
}
identity– Public key of the signing identity.type– Type of key used for signing.value– Signature value.
"signature": {
"identity": "023531430d1053f4eeab4bf520522186698d7e16d53cf0e80df35a158c7a74261e",
"type": "ES256K",
"value": "MEUCIQDd0qjbTLAWH2egv3qMKE7afW8O/Ki1Wgum2bwBP/ziHAIgBBtDcYgqdBCUs1P+pV2ZYr/awSd10FkXiGCPKCDk944="
}
Verify a block's signature
If a block's signature is correctly verified, you have a cryptographic guarantee that the commit was authored by the identity saved in the signature.
- CLI
- HTTP API
You can verify that the signature is valid for a block with the CLI command defradb client block verify-signature <public-key> <cid>.
defradb client block verify-signature 023531430d1053f4eeab4bf520522186698d7e16d53cf0e80df35a158c7a74261e bafyreidapjfuskkddbuu5eevkf5usgv6biot7dqlmxau7g5copqr2ax6ha
Block's signature verified
You can verify that the signature is valid for a block by submitting a GET request to the HTTP endpoint /block/verify-signature, providing public-key and cid as parameters. The request doesn't need to be authenticated. Successful verification yields no output.
GET http://localhost:9181/block/verify-signature?public-key=<public-key>&cid=<cid> HTTP/2
accept: application/json
At height > 1, only composite blocks are signed. Field blocks are only signed at height = 1 to seed entropy for the upcoming chain of commits. There's no cryptographic need to sign field blocks at every height; signing composites is enough to guarantee integrity.