What does signing a crypto transaction or message prove?

What a signature proves

Mastering Ethereum says a digital signature does three jobs.¹

• Approval. It proves that the owner of the private key approved the payment or the contract call.¹
• No take-backs. The approval can't be denied later. The book calls this nonrepudiation.¹
• No changes. It proves the signed data hasn't been, and can't be, changed by anyone after signing.¹

Only someone who knows the private key can make the signature.² But anyone with the public key and the data can check it.² On Ethereum, the sender's public key can even be worked out from the signature itself, so a transaction doesn't need a "from" field.¹

Signing doesn't reveal the key

When a signature is checked, Mastering Ethereum says, the private key is neither known nor revealed.¹ Private keys are never sent to the network. Only addresses and signatures are sent and stored.⁵

So you can't work backwards from a signature to the key.^1,5 What a signature does give away is permission: it is your approval of that exact piece of data.¹

Signing messages, not only transactions

ethereum.org notes that you need your private key to sign both messages and transactions.³ Here, a "message" means signed data that is not a transaction.^6,7

• Signing in. Sign-In with Ethereum, a 2021 standard (ERC-4361), lets you log in to a website by signing a standard message.⁸ ethereum.org describes a wallet as a login you can use across many apps.⁹
• Plain messages. A standard called ERC-191 adds a fixed prefix to signed data. Because of that prefix, a signed message can never be a valid Ethereum transaction.⁶

Typed data: EIP-712

A 2017 standard, EIP-712, starts from a problem: signed messages used to show up as an unreadable string of hex, with little context.⁷ Its fix is to sign structured data, so the wallet can show each field to you before you sign.⁷

Each EIP-712 message also says where it belongs. Its "domain" can include the name of the app, the chain it is for, and the contract that will check the signature.⁷ The standard says a wallet should refuse to sign if the chain doesn't match the one in use.⁷

A message can still move money

Not signing a transaction doesn't mean nothing can happen. A token standard called ERC-2612 adds a function named permit. It lets you change how many of your tokens another address may spend, using a signed message instead of a transaction.⁴

The standard's goal was to let people use tokens without holding ETH to pay gas.⁴ The other side of that convenience is that a single signature can hand over spending power over your tokens (Module 12 covers token allowances, and Module 10 covers permit scams).⁴

Blind signing

Ledger, a hardware-wallet maker, uses the term blind signing for approving something you can't read: the device can't show the details, only a raw hash.¹⁰ Ledger compares it to signing a blank cheque.¹⁰

Ledger says scammers have used blind signing to take billions of dollars from users.¹⁰ It says blind signing is turned off by default on its own devices.¹⁰ ethereum.org calls it good practice, when interacting with a smart contract, to read the transaction message before signing.¹¹