Signing messages

A signature proves you hold the private key for an address without revealing the key. Every signature in Divi Games is a Divi signmessage signature, so any Divi wallet can produce one:

• Divi Core: divi-cli signmessage <address> "<message>"
• The IronDivi extension: window.irondivi.signMessage(message)
• The SDK's guest key, in the browser games.

How it works

Divi does not sign your text directly. It hashes it with a fixed prefix first:

hash = SHA256(SHA256( varstr("DarkNet Signed Message:\n") || varstr(message) ))
sig  = base64( header || r[32] || s[32] )      header = 27 + recid + 4 (compressed key)

varstr(x) is a length (Bitcoin's compact-size encoding) followed by the bytes of x. The prefix means a signed message can never be mistaken for a signed transaction on some other system.

Verifying

Verification recovers the public key from (hash, signature), turns it into an address and checks that it equals the address the signer claimed. The node does this with dg_core::crypto, and the site does it with the same code. The implementation is tested against Divi Core's own verifymessage.

Where the site uses it

To link a Divi address to your Telegram login, the site shows a sentence such as:

games.divi.domains wants to link <addr> to telegram:<id> nonce:<n>

You sign exactly that text with any Divi wallet and paste back the signature. Read what you sign: the text is the whole contract. The nonce stops someone replaying an old signature.