Lab: sign something you cannot read

The signing lesson said that raw digest signing bypasses your guardrails, and that a 32-byte hash tells you nothing about what it authorises. Both are easy to accept in the abstract and easy to trade away when an integration is blocked. Build it once and the trade becomes concrete.

1. 1

   Build the typed structure and its digest. This is the EIP-712 shape: a domain separator, a hash of the typed struct, and the two combined behind the 0x1901 prefix.

   bash Copy

   mkdir -p /tmp/blindlab && cd /tmp/blindlab
   cat > typed.py <<'EOF'
   import hashlib, json
   h = lambda b: hashlib.sha256(b).digest()
   
   DOMAIN = {"name": "DemoDEX", "version": "1", "chainId": 8453,
             "verifyingContract": "0xDEX0000000000000000000000000000000000dex"}
   TYPE = "Transfer(address to,uint256 value,uint256 deadline)"
   
   domain_separator = lambda d: h(json.dumps(d, sort_keys=True).encode())
   struct_hash = lambda m: h(TYPE.encode() + json.dumps(m, sort_keys=True).encode())
   digest = lambda d, m: h(b"\x19\x01" + domain_separator(d) + struct_hash(m))
   
   benign = {"to": "0xAlice000000000000000000000000000000alice",
             "value": 1, "deadline": 1767225600}
   drain  = {"to": "0xMallory00000000000000000000000000mallory",
             "value": 10**24, "deadline": 1767225600}
   
   for name, m in (("benign", benign), ("drain", drain)):
       print(f"{name:8} to={m['to'][:14]}... value={m['value']:<25} "
             f"digest={digest(DOMAIN, m).hex()[:32]}...")
   EOF
   python3 typed.py

2. 2

   Two payloads, two digests. Reading the typed data, the difference is obvious.

   text Copy

   benign   to=0xAlice0000000... value=1                         digest=f7ea1df01073d3017aa7f99520be29be...
   drain    to=0xMallory00000... value=1000000000000000000000000 digest=14aa45ebac6ed98e2a66325486425220...

3. 3

   Now add a guardrail of the kind the Intents API applies: a recipient allowlist and a value cap.

   bash Copy

   cat >> typed.py <<'EOF'
   
   MAX_VALUE = 1000
   ALLOWED = {"0xAlice000000000000000000000000000000alice"}
   
   def guard_typed(m):
       if m["to"] not in ALLOWED:
           return f"DENY: recipient {m['to'][:14]}... not on the allowlist"
       if m["value"] > MAX_VALUE:
           return f"DENY: value {m['value']} exceeds cap {MAX_VALUE}"
       return "ALLOW"
   
   print("\n=== guardrail with the typed data ===")
   for name, m in (("benign", benign), ("drain", drain)):
       print(f"  {name:8} {guard_typed(m)}")
   EOF
   python3 typed.py

4. 4

   It works exactly as intended. The drain is refused on the recipient before the value is even considered.

   text Copy

   === guardrail with the typed data ===
     benign   ALLOW
     drain    DENY: recipient 0xMallory00000... not on the allowlist

5. 5

   Now give the same guardrail what a raw signing request actually contains: 32 bytes.

   bash Copy

   cat >> typed.py <<'EOF'
   
   def guard_digest(d32):
       # Nothing to inspect. A hash is one-way by construction.
       return "ALLOW (cannot determine recipient or value from 32 bytes)"
   
   print("\n=== the same guardrail with only a digest ===")
   for name, m in (("benign", benign), ("drain", drain)):
       print(f"  {name:8} {guard_digest(digest(DOMAIN, m))}")
   EOF
   python3 typed.py

6. 6

   This is the whole lab. The guardrail that caught the drain a moment ago now allows it, and nothing failed, errored or warned.

   text Copy

   === the same guardrail with only a digest ===
     benign   ALLOW (cannot determine recipient or value from 32 bytes)
     drain    ALLOW (cannot determine recipient or value from 32 bytes)

7. 7

   Finish the job: sign the drain digest without ever seeing what it authorises.

   bash Copy

   openssl genpkey -algorithm ed25519 -out k.pem
   python3 -c "
   import typed
   open('digest.bin','wb').write(typed.digest(typed.DOMAIN, typed.drain))
   "
   openssl pkeyutl -sign -inkey k.pem -rawin -in digest.bin -out d.sig
   wc -c < d.sig   # a valid 64-byte signature over bytes you never inspected

8. 8

   Clean up.

   bash Copy

   cd /tmp && rm -rf blindlab

Nothing in that sequence was a bug. The hash function did its job, the guardrail ran, the signature is cryptographically valid, and the transfer is authorised. The guardrail simply had nothing to inspect, because a digest is one-way by construction and that is the property it exists to have.

• Guardrails on typed data work because the server can read the fields: recipient, value, chain, verifying contract.
• Guardrails on a raw digest cannot work, in principle rather than in this implementation. No amount of engineering recovers the preimage.
• This is why raw_signing_enabled is off by default, human-set only, and audit-logged as signing_key.raw_digest_sign. It is not a lesser setting, it is a different security model.

A useful habit whenever you meet a signing request: ask what the signer can see. If the answer is 32 bytes, then every control you believe you have is running somewhere else, and you should be able to name where.