AttestedSigner

Attested signer utilities (TIP-1159 to TIP-1163). Experimental.

An attested signer is a program in a trusted execution environment whose P256 program key the Attested Key Registry precompile records after verifying an attestation document. The program key signs attested signatures (type 0x06) for the address derived from a policy ID and a user tag. Derives attested addresses, policy IDs, registration bindings, key IDs, and the digest a program key signs, and exposes the registry ABI and address.

TIP-1159 · TIP-1160 · TIP-1161

Examples

import { AttestedSigner } from 'ox/tempo'
 
const policyId = AttestedSigner.getPolicyId({
  creator: '0x0101010101010101010101010101010101010101',
  salt: `0x${'55'.repeat(32)}`
})
 
const address = AttestedSigner.getAddress({
  policyId,
  userTag: `0x${'bb'.repeat(32)}`
})

Functions

Name	Description
`AttestedSigner.getAddress`	Computes the address an attested signature signs for: `keccak256(0x06 ‖ policyId ‖ userTag)[12:]`.
`AttestedSigner.getBinding`	Computes the binding an attestation document commits to, so that the Attested Key Registry registers the program key only for this chain, registry, policy, slot, and requested lifetime: `keccak256("tempo:attested-key" ‖ uint256 chainId ‖ registry ‖ policyId ‖ uint8 slot ‖ x ‖ y ‖ uint64 lifetime)`.
`AttestedSigner.getKeyId`	Computes a program key's ID, as the registry's `KeyRegistered` event carries it: `keccak256(policyId ‖ x ‖ y)`.
`AttestedSigner.getPolicyId`	Computes the ID of the policy that `creator` creates with `salt`: `keccak256(abi.encode(creator, salt))`.
`AttestedSigner.getSignPayload`	Computes the digest a program key signs for an attested signature over the context digest `payload`: `keccak256("tempo:attested-signature" ‖ payload ‖ keccak256(rlp([policyId, userTag, slot, programKey, validUntil])))`.