HOW TO: Sign and verify messages

[PulsarAV]

I recently had the need to sign a message and the lack of a clear explanation about the "how to", and the "what is it doing" was very frustrating.  I had to piece together the answers.

So, with that being said, here is my attempt at answering the questions above for the benefit of others.  All feedback (errors, omissions, etc...) is welcome.

First some nomenclature clarifications:

Send Address:  This is the BTC address of the seller/person that you are sending BTC to.
Sending Address: This is YOUR address (in your wallet known as a receive address) that the BTC is coming from.
Receive Address: This is YOUR address (also known as the Sending Address when you send BTC) that the BTC is coming to when you receive BTC


The "How to":

I will use the bitcoin-qt wallet (v0.8.2-beta) for reference.

In your wallet, click on the Receive button and locate the "Sign Message" button at the bottom.

http://s22.postimg.org/vojynbopt/screenshot_1.png

Click on the "Sign Message" button to open the sign message window
http://s22.postimg.org/8lb0hnh7l/screenshot_2.png

Find your Sending address:

If you have a single address in the Receive window - that's it, your Sending Address.  If you have multiple addresses in the Receive window like in the example above, you can go to https://blockchain.info/ and search for your last transaction.

http://s22.postimg.org/k0qdc5gip/screenshot_4.png

Once you know your sending address, select it from your addresses in the sign message window.

Write your message in the message area.

Generate a signature by clicking on the Sign Message button.

NOTE: Once you generate a signature, DO NOT modify anything in the Sign Message window.  If you do, the signature becomes invalid.

Now that you have the signature, SELECT, COPY, and PASTE the Sending address, Message, and Signature into a private message or email to the merchant for the merchant to verify.

I suggest the following format for the PM or email however the merchant may have other requirements.

Sending Address:
13FquMwkrDwj2yYFp2XJSgf4uKbfLbzTPc

Message:
---BEGIN WITH LINE BELOW ----
PulsarAV just sent you 40 BTC for the purchase of 20 Block Erupter USB Miners

Please ship to:
PulsarAV
1234 Anywhere Street
AnyCity, AnyState, AnyZip

Thanks,
---END WITH LINE ABOVE---

Signature:
HNtryLdIkjfWZ/8jGzoH255Aa96xG3sa+j5/XrrAjoL3NZ6YoseNMvYxRpBZNlwK+TeJP/JASJijHozKpUlXa8w=



The "What is it doing?":

The bitcoin wallet takes the information you provide (Sending Address and Message) and generates a unique cryptological Key (the signature).
The merchant takes the same information and copies it into the Verify window of his wallet and the wallet's algorithm verifies the message came from your wallet.  This proves you own that address and the BTC came from you.

I hope this helps someone avoid the frustration I had when trying to figure out the Sign Message feature of Bitcoin.

PulsarAV
13FquMwkrDwj2yYFp2XJSgf4uKbfLbzTPc

 

[1715137668]

1715137668

[1715137668]

1715137668

[Birdy]

Thank you for making a nice explantion, I will suggest people wondering about signing to read this thread

[tcrasher]

nice explantion

[Alpha|FWZ]

Good info Thanks!

[Lethn]

wow thanks, I was aware of those buttons but I wasn't entirely sure what they did, like with a lot of stuff programmers do not just with Bitcoins you never get explanations as clear as this.

[Chrithu]

Any mod please sticky this thread. That's exactly the kind of info that should be posted more frequently into the newbie area instead of the announcement for the next possible opportunity to burn money through gambling (Ignore my sig, I just take their money for advertising. I'm not using the site, since I am not into gambling, if you are into gambling that's fine and this site should satisfy you).

[jackjack]

wow thanks, I was aware of those buttons but I wasn't entirely sure what they did, like with a lot of stuff programmers do not just with Bitcoins you never get explanations as clear as this.

Ask for a How to in the dev forum, and I'm SURE at least one of the ones you will get will be clear

Any mod please sticky this thread. That's exactly the kind of info that should be posted more frequently into the newbie area instead of the announcement for the next possible opportunity to burn money through gambling (Ignore my sig, I just take their money for advertising. I'm not using the site, since I am not into gambling, if you are into gambling that's fine and this site should satisfy you).

Ask for How to's in the dev forum, some of them will be glad to make one

[DannyHamilton]

All in all, a pretty good tutorial.  Be aware however that the following statement is not necessarily true:

- snip -
Find your Sending address:

If you have a single address in the Receive window - that's it, your Sending Address.
- snip -

Because of the way the Bitcoin-Qt wallet handles "change" it is entirely possible that your bitcoins "come from" an address that is not in your Receive window at all.  If you want to be sure that you are signing with the correct address, you'll have to wait until after you've already sent the bitcoins, and then you'll have to look up the transaction somewhere (such as blockchain.info).

[darkfriend77]

nice info :-)

[tehsoto]

Thanks for the info.

[sf2]

 

[mrmann]

Thanks. Good info.

[riazg]

I have an online blockchain wallet. How can I do this for an online wallet?

[Dealer]

Thanks for this, explains it really well!

[tuntap]

Thanks for the info!

[drico]

Thanks

[pand70]

I m confused because i don't really now alot about cryptography.

Which key the software uses to create the signature?

And which key the receivers wallet uses to verify the message?

Thanks.

[DannyHamilton]

I m confused because i don't really now alot about cryptography.

Which key the software uses to create the signature?

And which key the receivers wallet uses to verify the message?

Thanks.

Your wallet uses the private key associated with the address to create the signature.  It is called "private" because only you have access to it.  Since nobody else has access to it, they certainly wouldn't be able to use it to verify the signature.

The receiver's wallet uses the public key associated with the address to verify the signature.  It is called "public" because it is what is made publicly available to anyone that would verify a signature.

[MikeMike]

When Canary asks for a signed message sent separately the below is what they are asking for.
Nothing but your shipping address.
No blank lines nor spaces.


-------------BEGIN---------------------
Please ship to:
John Smith
123 Way Ave
City, IL 60188
--------------END----------------------


https://bitcointalk.org/index.php?topic=219422.msg2310127#msg2310127

[CDI]

Good info