lucashenning

  function withdraw(string memory headerJson, string memory payloadJson, bytes memory signature, uint amount) public {
    // validate JWT
    string memory email = validateJwt(headerJson, payloadJson, signature);
    bytes32 emailHash = keccak256(abi.encodePacked(email));
    
    // balance check
    // this uses the email address from the Google JWT to check if there is a balance for this email
    require(balances[emailHash] > 0, "No balance for this email");
    require(balances[emailHash] >= amount, "Not enough balance for this email");

lucashenning

#!/bin/bash

# Put this in your Amazon Elastic Beanstalk repo 
# Tested on Amazon Linux 2, Node.JS v16, puppeteer v15.3.0
# File path: .platform/hooks/postdeploy/01_install_libs.sh

sudo amazon-linux-extras install epel -y

cd node_modules/puppeteer/
cd .local-chromium/linux-*/chrome-linux

lucashenning

const EcdsaSigAsnParse = asn1.define('EcdsaSig', function(this: any) {
    this.seq().obj(
        this.key('r').int(),
        this.key('s').int(),
    );
});

lucashenning

async function sign(msgHash, keyId) {
    const params : KMS.SignRequest = {
        KeyId: keyId,
        Message: msgHash,
        SigningAlgorithm: 'ECDSA_SHA_256',
        MessageType: 'DIGEST'
    };
    return kms.sign(params).promise();
}

lucashenning

const EcdsaPubKey = asn1.define('EcdsaPubKey', function(this: any) {
    // https://tools.ietf.org/html/rfc5480#section-2
    this.seq().obj(
        this.key('algo').seq().obj(
            this.key('algorithm').objid(),
            this.key('parameters').objid(),
        ),
        this.key('pubKey').bitstr() // <-- this is what we want
    );
});

lucashenning

import { KMS } from 'aws-sdk';
const kms = new KMS({
    accessKeyId: '<access_key_id>',
    secretAccessKey: '<access_secret>',
    region: 'us-east-1',
    apiVersion: '2014-11-01',
});
kms.getPublicKey({
    KeyId: '<KMS key id>'
});

lucashenning

const web3 = new Web3(new Web3.providers.HttpProvider("https://kovan.infura.io/v3/<your key>"));

let pubKey = await getPublicKey(keyId);
let ethAddr = getEthereumAddress((pubKey.PublicKey as Buffer));
let ethAddrHash = ethutil.keccak(Buffer.from(ethAddr));

// signing the 1st time
// we're signing the hash of our ethereum address
let sig = await findEthereumSig(ethAddrHash);
let recoveredPubAddr = findRightKey(ethAddrHash, sig.r, sig.s, ethAddr);

lucashenning

function recoverPubKeyFromSig(sig: Buffer, r : BN, s : BN, v: number) {
    console.log("Recovering public key with sig " + sig.toString('hex') + " r: " + r.toString(16) + " s: " + s.toString(16));
    let rBuffer = r.toBuffer();
    let sBuffer = s.toBuffer();
    let pubKey = ethutil.ecrecover(sig, v, rBuffer, sBuffer);
    let addrBuf = ethutil.pubToAddress(pubKey);
    var RecoveredEthAddr = ethutil.bufferToHex(addrBuf);
    console.log( "Recovered ethereum address: " +  RecoveredEthAddr);
    return RecoveredEthAddr;
}

lucashenning

async function calcEthSig(plaintext) {
    let signature = await sign(plaintext, keyId);
    if (signature.Signature == undefined) {
        throw new Error('Signature is undefined.');
    }
    console.log("encoded sig: " + signature.Signature.toString('hex'));

    let decoded = EcdsaSigAsnParse.decode(signature.Signature, 'der');
    let r : BN = decoded.r;
    let s : BN = decoded.s;

lucashenning

function getEthereumAddress(publicKey: Buffer): string {
    console.log("Encoded Pub Key: " + publicKey.toString('hex'));

    // The public key is ASN1 encoded in a format according to 
    // https://tools.ietf.org/html/rfc5480#section-2
    // I used https://lapo.it/asn1js to figure out how to parse this 
    // and defined the schema in the EcdsaPubKey object
    let res = EcdsaPubKey.decode(publicKey, 'der');
    let pubKeyBuffer : Buffer = res.pubKey.data;
    console.log("Pub Key Buffer: " + pubKeyBuffer.toString('hex'));