user2158: I'm trying to implement what's discussed in this topic: How to verify data signed with nami wallet in a node backend? but in Java.
Obviously I don't have the js/rust lib I can play with, so I have to implement/integrate all the bits myself.
While I've successfully implemented the code to use the Ed25519 standard, and in this repo there is the code and a few examples github I don't seem to be able to verify the data returned by the signData method of the wallet (that I assume uses the same standard).
Now it's my understading that the COSE object contains all that I need to at least verify the payload has been signed with the public key returned with COSE object itself. Looking at the sample in the post above, and using the https://cbor.me/ website, I guess that:

674D11E432450118D70EA78673D5E31D5CC1AEC63DE0FF6284784876544BE340 is the HEX of the signed message
68656C6C6F is the HEX of the message to sign
01D2EB831C6CAD4ABA700EB35F86966FBEFF19D077954430E32CE65E8DA79A3ABE84F4CE817FAD066ACC1435BE2FFC6BD7DCE2EC1CC6CCA6CB is the HEX of the Base Address of the wallet
A3B5ACD99DF5F3B5E4449C5A116078E9C0FCFC126A4D4E2F6A9565F40B0C77474CAFD89845E768FAE3F6EEC0DF4575FCFE7094672C8C02169D744B415C617609 is the HEX of the Public Key of the wallet.

Now, if I used the public key at (4) along with signed (1) and unsigned (2), and I test with the code (taht I know that works!) I wrong for the verification, it doesn't pass. So I guess one of the assumption i wrong.
I'm sure that (2) is the hex of the message to sign, so now either (1) is not the signed message or (4) is not the public key. Or they are in a different format
In java the code I'm running looks like the following
var msg = "hello".getBytes(StandardCharsets.UTF_8);
var publicKey = new Ed25519PublicKeyParameters(Hex.decode("A3B5ACD99DF5F3B5E4449C5A116078E9C0FCFC126A4D4E2F6A9565F40B0C77474CAFD89845E768FAE3F6EEC0DF4575FCFE7094672C8C02169D744B415C617609"), 0);
var verifier = new Ed25519Signer();
verifier.init(false, publicKey);
verifier.update(msg, 0, msg.length);
var outcome = verifier.verifySignature(Hex.decode("674D11E432450118D70EA78673D5E31D5CC1AEC63DE0FF6284784876544BE340"));
System.out.println("Outcome: " + outcome);

Any help would be greatly appreciated

user7766: After the CIP-0030 update you won't get the publicKey in the protected headers, but rather in the response object from signData directly, so the above answer won't work anymore.
Here is the example of the verification after the update: https://github.com/MartinOndejka/cip-0008-verification

2158: <p>I'm trying to implement what's discussed in this topic: <a href="https://cardano.stackexchange.com/questions/2498/how-to-verify-data-signed-with-nami-wallet-in-a-node-backend">How to verify data signed with nami wallet in a node backend?</a> but in Java.</p>
<p>Obviously I don't have the js/rust lib I can play with, so I have to implement/integrate all the bits myself.</p>
<p>While I've successfully implemented the code to use the Ed25519 standard, and in this repo there is the code and a few examples <a href="https://github.com/speedwing/blockchain-auth-mech-dev/blob/master/lib/src/main/java/blockchain/auth/mech/signing/wallet/SigningService.java" rel="nofollow noreferrer">github</a> I don't seem to be able to verify the data returned by the signData method of the wallet (that I assume uses the same standard).</p>
<p>Now it's my understading that the COSE object contains all that I need to <em>at least</em> verify the payload has been signed with the public key returned with COSE object itself. Looking at the sample in the post above, and using the <a href="https://cbor.me/" rel="nofollow noreferrer">https://cbor.me/</a> website, I guess that:</p>
<ol>
<li><code>674D11E432450118D70EA78673D5E31D5CC1AEC63DE0FF6284784876544BE340</code> is the HEX of the signed message</li>
<li><code>68656C6C6F</code> is the HEX of the message to sign</li>
<li><code>01D2EB831C6CAD4ABA700EB35F86966FBEFF19D077954430E32CE65E8DA79A3ABE84F4CE817FAD066ACC1435BE2FFC6BD7DCE2EC1CC6CCA6CB</code> is the HEX of the Base Address of the wallet</li>
<li><code>A3B5ACD99DF5F3B5E4449C5A116078E9C0FCFC126A4D4E2F6A9565F40B0C77474CAFD89845E768FAE3F6EEC0DF4575FCFE7094672C8C02169D744B415C617609</code> is the HEX of the Public Key of the wallet.</li>
</ol>
<p>Now, if I used the public key at (4) along with signed (1) and unsigned (2), and I test with the code (taht I know that works!) I wrong for the verification, it doesn't pass. So I guess one of the assumption i wrong.</p>
<p>I'm sure that (2) is the hex of the message to sign, so now either (1) is not the signed message or (4) is not the public key. Or they are in a different format</p>
<p>In java the code I'm running looks like the following</p>
<pre><code>var msg = &quot;hello&quot;.getBytes(StandardCharsets.UTF_8);
var publicKey = new Ed25519PublicKeyParameters(Hex.decode(&quot;A3B5ACD99DF5F3B5E4449C5A116078E9C0FCFC126A4D4E2F6A9565F40B0C77474CAFD89845E768FAE3F6EEC0DF4575FCFE7094672C8C02169D744B415C617609&quot;), 0);
var verifier = new Ed25519Signer();
verifier.init(false, publicKey);
verifier.update(msg, 0, msg.length);
var outcome = verifier.verifySignature(Hex.decode(&quot;674D11E432450118D70EA78673D5E31D5CC1AEC63DE0FF6284784876544BE340&quot;));
System.out.println(&quot;Outcome: &quot; + outcome);
</code></pre>
<p>Any help would be greatly appreciated</p>
 7766: <p>After the <a href="https://github.com/cardano-foundation/CIPs/tree/master/CIP-0030" rel="nofollow noreferrer">CIP-0030</a> update you won't get the <code>publicKey</code> in the protected headers, but rather in the response object from <code>signData</code> directly, so the above answer won't work anymore.</p>
<p>Here is the example of the verification after the update: <a href="https://github.com/MartinOndejka/cip-0008-verification" rel="nofollow noreferrer">https://github.com/MartinOndejka/cip-0008-verification</a></p>
