verifySignature

function verifySignature(key, signature, data): Promise<boolean>;

Given a public CryptoKey, some SignatureBytes, and a Uint8Array of data, this method will return true if the signature was produced by signing the data using the private key associated with the public key, and false otherwise.

Verification is strict: signatures whose R component is a point of small order are rejected, as are public keys of small order (for which trivially forged signatures would otherwise verify against any data). This matches the behavior of the Solana runtime, and holds regardless of whether the underlying WebCrypto implementation performs these checks itself.

Checking the public key requires reading its bytes, so the key must be an extractable public key. The public keys produced by this library (eg. by generateKeyPair, getPublicKeyFromPrivateKey, and getPublicKeyFromAddress()) always are. If you import a public key yourself using crypto.subtle.importKey(), set extractable to true.

Parameters

Returns

Promise<boolean>

Throws

SOLANA_ERROR__KEYS__VERIFICATION_REQUIRES_EXTRACTABLE_PUBLIC_KEY when supplied a key that is not a public key, or a public key that is not extractable.

Example

import { verifySignature } from '@solana/keys';
 
const data = new Uint8Array([1, 2, 3]);
if (!(await verifySignature(publicKey, signature, data))) {
    throw new Error('The data were *not* signed by the private key associated with `publicKey`');
}