Validate uncompressed ETH public keys

src/__tests__/curve-detection.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from "vitest";
+import { detectPublicKeyCurve } from "../curve-detection.js";
+import { CurveType } from "../types.js";
+
+describe("detectPublicKeyCurve", () => {
+  it("accepts raw and uncompressed Ethereum secp256k1 public keys", () => {
+    expect(detectPublicKeyCurve("11".repeat(64))).toBe(CurveType.ETHSECP256K1);
+    expect(detectPublicKeyCurve("04" + "11".repeat(64))).toBe(CurveType.ETHSECP256K1);
+  });
+
+  it("rejects 65-byte Ethereum secp256k1 public keys without the uncompressed prefix", () => {
+    expect(() => detectPublicKeyCurve("05" + "11".repeat(64))).toThrow(
+      "65-byte ETHSECP256K1 keys must start with 0x04",
+    );
+  });
+});

src/curve-detection.ts

@@ -12,8 +12,10 @@ export function detectPublicKeyCurve(publicKeyHex: string): CurveType {
     case KEY_SIZES.PUBLIC.BLS12381:
       return CurveType.BLS12381;
     case KEY_SIZES.PUBLIC.ETHSECP256K1:
-    case 65:
       return CurveType.ETHSECP256K1;
+    case 65:
+      if (bytes[0] === 0x04) return CurveType.ETHSECP256K1;
+      throw new Error("Unrecognized public key format: 65-byte ETHSECP256K1 keys must start with 0x04");
     default:
       throw new Error(`Unrecognized public key format: ${bytes.length} bytes`);
   }