Archived article · Original source date: 2024-08-02
This article is preserved from the previous Solana Bulls site as a historical archive. It reflects its original context; references to products, people, market conditions, eligibility, or rules may no longer be current.
Public-key cryptography gives a signer a private key and a corresponding public key. The private key creates a signature over a message, and the public key lets others verify that signature.
What verification establishes
- The signature matches the specified message and public key.
- The signed message has not been altered without invalidating the signature.
- Someone or something with access to the signing key authorized that exact data.
What verification does not establish
- That the human signer understood the message.
- That a transaction is safe, fair, legal, or beneficial.
- That a website, program, token, or counterparty is legitimate.
- That the key was not stolen, coerced, or controlled by malware.
- That a human rather than automated software initiated the signature.
Blockchain transactions
On Solana, required signatures authorize the transaction message, which includes account addresses, instructions, and a recent blockhash. Wallets should help users interpret expected asset and permission changes before signing.
A transaction can contain multiple instructions and invoke other programs. Review the complete effect rather than treating a familiar first instruction or valid signature as proof of safety.
Protecting signing authority
Use verified wallet software, protected recovery, appropriate hardware or multisignature arrangements, and independent transaction review for high-value actions. If a key is compromised, signatures made by the attacker can still be cryptographically valid.