New AdEx Bounty: Verify DKIM Signatures

We’re challenging developers with an exciting task that will enable a next-generation UX for dApps where you can sign up with an email/password.

Exciting news, everyone, exciting news. We’ve issued yet another developer bounty on Gitcoin. This time, we’re challenging coders to come up with a way of verifying DKIM signatures generated by Gmail or other providers. The ultimate goal of this is to enable easier account recoveries and bring the UX of Web3 a level up.

The prize of this challenge is 1,800 dai ($1,800) and developers have until November 11 to complete it. The task requires in-depth coding skills so noobs are likely to struggle — but we’re still encouraging anyone with the right level of talent to give it a try. All the details are below — and of course, on the challenge page.

The Challenge

Since most emails are signed cryptographically through DKIM, and contain enough data to prove who the sender is (from wikipedia: “the From: field must always be signed”), we can use that for recovering Ethereum accounts.

Such a solution could enable a next-generation UX for dApps where you can sign up with an email/password, without significantly compromising security, and with an ability to change your password and recover your account.

#Web3World

Of course, it’s not a silver bullet, as you’re ultimately trusting your email provider. But trusting the email provider is no doubt more realistic for most people than trusting a startup to keep your private key.

The challenge is to build a proof of concept that verifies a real DKIM signature from an email generated by Gmail, via a Solidity smart contract, on-chain, within a reasonable gas limit.

The technical requirements

We basically need a solidity contract to verify the DKIM-Signature field based on a certain body; It needs to check the signature agianst the _domainkey TXT record for the domain, for which we'll need a key "oracle": for this PoC, it's sufficient to just hardcode the _domainkey records for gmail.com and any other large providers, but in the future, we'll need a proper oracle that can read the _domainkeyrecord for any arbitrary domain.

Spec: https://dkim.org/specs/rfc4871-dkimbase.html

RSA and ed25519 crypto will be needed, which is not supported out of the box but these resources can help:

• https://github.com/javgh/ed25519-solidity
• https://github.com/HarryR/ethsnarks/blob/master/contracts/ETEC.sol — this will work for all twisted Edwards curves, so if the modulus is changed it should work with ed25519
• RSA is easier because of EIP 198 in byzantium: see https://github.com/adria0/SolRsaVerify
• Various signature schemes are implemented by the dnssec-oracle: https://github.com/ensdomains/dnssec-oracle/tree/master/contracts/algorithms

Submission requirements:

• Gas cost: should be under 3 million gas;
• Can verify a DKIM signature generated by Gmail;
• Implement a script that takes a raw email as input and invokes a method on a solidity smart contract (on a local network, with ganache/truffle) to check this email’s signature.

The deadline for submitting is November 11 and we will evaluate submissions on the following day. Here are the judging criteria:

• Gas cost;
• Elegance of the solution;
• Support the signature schemes by large email providers (Gmail, Outlook, Yahoo, ProtonMail);
• Contributions to other open-source packages will be appreciated.

Already intrigued? Head over to the bounty page and start hacking. We can’t wait to see your work!

Useless trivia fact

One of the AdEx developers, Sam, first got our attention by working on another AdEx challenge on Gitcoin. He is now a full-time AdEx team member.

Interested in AdEx? Follow us:
X (Twitter) | Telegram | Reddit | Facebook | LinkedIn | Discord