verifySignature method

bool verifySignature({ required String messageId, required String senderId, required String targetId, required Uint8List payload, required int createdAt, required String signature, })

Verifies that a message's signature is valid.

Returns true if the signature matches, false if tampered.

Note: This can only verify messages signed with the SAME key. For messages from other nodes, the signature serves as a tamper-detection mechanism — if a relaying node modifies the payload, the signature won't match when the original sender (or any node with the same key) verifies it.

Implementation

bool verifySignature({
  required String messageId,
  required String senderId,
  required String targetId,
  required Uint8List payload,
  required int createdAt,
  required String signature,
}) {
  final expected = signMessage(
    messageId: messageId,
    senderId: senderId,
    targetId: targetId,
    payload: payload,
    createdAt: createdAt,
  );
  // Constant-time comparison to prevent timing attacks
  return _constantTimeEquals(expected, signature);
}