verify static method

bool verify(String token, Uint8List publicKey)

Whether token was signed by publicKey.

Provided because a signature nobody can check is not evidence of anything: this is what lets a test hold the implementation against a token it did not produce.

Implementation

static bool verify(String token, Uint8List publicKey) {
  final parts = token.split('.');
  if (parts.length != 3) return false;
  final signature = dvWebPushBase64Decode(parts[2]);
  if (signature.length != 64) return false;

  final domain = ECDomainParameters('prime256v1');
  final verifier = ECDSASigner(SHA256Digest())
    ..init(
      false,
      PublicKeyParameter<ECPublicKey>(
        ECPublicKey(domain.curve.decodePoint(publicKey), domain),
      ),
    );
  return verifier.verifySignature(
    Uint8List.fromList(utf8.encode('${parts[0]}.${parts[1]}')),
    ECSignature(
      _toBigInt(signature.sublist(0, 32)),
      _toBigInt(signature.sublist(32)),
    ),
  );
}