[LOW] Server-side signing uses SHA-256 hash instead of Ed25519 digital signature

[Alqku]

Overview

The sign_server_side method in signing_request.rs produces a SHA-256 hash of (secret_key || transaction_xdr), not a proper Ed25519 digital signature. This hash cannot be independently verified by a third party without knowing the secret key.

Evidence

// signing_request.rs
pub fn sign_server_side(&self, secret_key: &str) -> Result<ServerSignedTransaction> {
    let mut hasher = Sha256::new();
    hasher.update(secret_key.as_bytes());
    hasher.update(self.transaction_xdr.as_bytes());
    let signature = hex::encode(hasher.finalize());
    // ...
}

A proper Ed25519 signature would be verifiable with only the public key. This hash-based approach requires the verifier to also know the secret key to recompute the hash, defeating the purpose of asymmetric signing.

Impact

• The "signature" is not independently verifiable
• Cannot be used for third-party attestation or audit
• Provides weaker security guarantees than Ed25519

Recommended Approach

Either:

1. Integrate ed25519-dalek crate and produce proper Ed25519 signatures verifiable with the public key, or
2. Document that this is a server-internal MAC (Message Authentication Code), not a digital signature, and rename accordingly (e.g., server_side_hmac)

Acceptance Criteria

• Decision made: implement Ed25519 or rename to HMAC
• If Ed25519: signatures verifiable without the secret key
• If HMAC: function renamed, documentation updated

Affected Files

• crates/tools/src/signing_request.rs
• crates/tools/Cargo.toml — add ed25519-dalek dependency (if option 1)

[gbengaeben]

Hi Maintainer,

I’d love to work on this issue. I’ve reviewed the requirements and believe I can implement the solution according to the project’s guidelines and best practices.

If the issue is available, I’d be happy to take ownership and submit a PR for review.

Thank you for your consideration

[grantfox-oss]

🦊 GrantFox — @gbengaeben has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #12)
2. Your PR will be reviewed by the OrbitChainLabs maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@gbengaeben's PR #74 was approved and merged by @Alqku.

🏆 @gbengaeben: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (436 total points). Track your full progress on GrantFox.

👏 Great work, @gbengaeben! Keep contributing to OrbitChainLabs.