siwe-rb 0.1.2 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f43daa18ea4cad6fad589c66ec33ab0e42fe605371705b9f6b6b9c42a00d619
-  data.tar.gz: 251ff4c5139a8632090db0db4480020bfe954a595d855d13e9a45ede412feaf4
+  metadata.gz: 4b6bc3df2351b75f3628baf83e1a49b32967538ce242b76407b0d978f7777fa2
+  data.tar.gz: ddfd9da52f3d0dd77504c3df22ec547091b7038356623891ac465d008298d68b
 SHA512:
-  metadata.gz: 82a18c3a0584046085715bd316d8eda59628b6b92696f2b219adb8e3115546cdcbf2deb3c72996a36550a8fa0966a25a15acfeacbc1416386c153b9a8d771c5a
-  data.tar.gz: 88b136c8941313f6d11cf9ea6bb03c538d2e00f09ea4b40fa5806810eb2efbb381f14d738cb2266c36151c9104cab1e0af37f23c7c44e17441e984afc90163dd
+  metadata.gz: b318a4225a6ea4c31c142720ba981a0fd6d465f69a0e150aece84898a5144299c0b8e5f4b89db75c230fe156a9a76f0b21f8ed926da8884458a05aab078e2f77
+  data.tar.gz: d5980f23b3f96765fcdf617998cb5d0554aa326fef6c0a2bf9401943a53478bbec452b1f552d0f87d57c9c70f5cf6b99e5bdb6e2b7b36411919ab1d1b9045555

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.3.0] — 2026-09-11
+
+- Replace the `eth` runtime dependency with `keccak` and Ruby OpenSSL for EOA signer recovery, EIP-55 checksums, EIP-191 hashing, and smart-wallet ABI encoding. This removes `rbsecp256k1` and its conflicting build-tool dependencies from installations such as Discourse.
+- Default to `Siwe::Adapter::OpenSSL`; remove `Siwe::Adapter::EthGem`. Custom adapters should raise `Siwe::Crypto::SignatureError` for recovery failures. Message verification APIs and smart-wallet chain binding are unchanged.
+- Signing with `eth` now requires an explicit application dependency. Package smoke tests and the regular test suite no longer depend on it.
+- Preserve EOA verification of raw binary signatures and `0X`-prefixed hex. Malformed contract-signature hex now returns `:invalid_signature` without calling RPC; odd-length hex is rejected instead of implicitly left-padded.
+- Propagate OpenSSL configuration errors instead of reporting them as invalid signatures.
+
+## [0.2.0] — 2026-05-26
+
+Spec-conformance pass. Several behaviour changes; the only one that breaks API contract is the strict chain-id requirement on the smart-wallet path (3).
+
+1. **RFC 3986 enforcement for `domain`, `URI`, and resource URIs.** The previous regexes accepted malformed authorities (`example.com:abc`), IP-literal hosts with invalid IPv4 octets (`uri://[::0.0.0.256]/p`), and URI characters outside RFC 3986 (`https://example.com/path?q=one|two`). The shared test-vector suite's `invalid_uris` / `invalid_resources` grammar cases were silently passing because the spec wrapper called `vec["msg"]` on raw-string entries; both the parser and the spec are fixed.
+2. **Expiration boundary now matches sibling implementations.** A message is rejected at the exact `Expiration Time` (not one instant after), aligning with TypeScript / Python / Rust.
+3. **Smart-wallet chain binding is enforced, not best-effort.** ERC-4361 requires ERC-1271 verification to happen on the chain matching the message's `Chain ID`. Previously, an RPC that lacked `chain_id` or whose `eth_chainId` probe failed would silently skip the check. Now `:invalid_signature_chain_id` is raised in either case. **Breaking** for callers using a custom RPC client without a `chain_id` method, or relying on `chain_id` returning `nil` on probe failure.
+4. **`request-id` field tightened to `*pchar`.** The parser previously accepted `/` and `?` (ABNF query/fragment characters) which are not pchar.
+5. **Empty / nil signatures now raise `:invalid_params`** instead of `:invalid_signature` — same `Siwe::Error` class, more specific type.
+6. **Narrower `rescue` in EOA recovery.** Adapter misconfiguration no longer disappears behind `:invalid_signature`; only `eth`-gem signature/chain errors and arg/type errors are swallowed.
+7. **Removed unused public surface.** `Config#verification_fallback`, `Eip6492::EIP1271_MAGIC_VALUE`, and `Adapter::EthGem#{hash_message,get_address}` are gone. None were called anywhere.
+
 ## [0.1.2] — 2026-05-04
 
 - Add top-level convenience methods `Siwe.parse(str)` (alias for `Siwe::Message.parse`) and `Siwe.eip6492_signature?(hex)` (alias for `Siwe::Eip6492.signature?`), mirroring the TS package's root-level exports.

data/Gemfile.lock

@@ -1,8 +1,8 @@
 PATH
   remote: .
   specs:
-    siwe-rb (0.1.2)
-      eth (>= 0.5.11, < 1.0)
+    siwe-rb (0.3.0)
+      keccak (~> 1.3)
 
 GEM
   remote: https://rubygems.org/
@@ -10,70 +10,26 @@ GEM
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
-    base64 (0.3.0)
     bigdecimal (3.3.1)
-    bls12-381 (0.3.1)
-      bigdecimal
-      h2c (>= 0.2.1, < 0.3)
     crack (1.0.1)
       bigdecimal
       rexml
     diff-lcs (1.6.2)
     docile (1.4.1)
-    ecdsa (1.2.0)
-    eth (0.5.17)
-      base64 (~> 0.1)
-      bigdecimal (~> 3.1)
-      bls12-381 (~> 0.3)
-      forwardable (~> 1.3)
-      httpx (~> 1.6)
-      keccak (~> 1.3)
-      konstructor (~> 1.0)
-      openssl (~> 3.3)
-      rbsecp256k1 (~> 6.0)
-      scrypt (~> 3.0)
-    ffi (1.17.4)
-    ffi (1.17.4-aarch64-linux-gnu)
-    ffi (1.17.4-aarch64-linux-musl)
-    ffi (1.17.4-arm-linux-gnu)
-    ffi (1.17.4-arm-linux-musl)
-    ffi (1.17.4-arm64-darwin)
-    ffi (1.17.4-x86-linux-gnu)
-    ffi (1.17.4-x86-linux-musl)
-    ffi (1.17.4-x86_64-darwin)
-    ffi (1.17.4-x86_64-linux-gnu)
-    ffi (1.17.4-x86_64-linux-musl)
-    ffi-compiler (1.4.2)
-      ffi (>= 1.15.5)
-      rake
-    forwardable (1.4.0)
-    h2c (0.2.1)
-      ecdsa (~> 1.2.0)
     hashdiff (1.2.1)
-    http-2 (1.1.3)
-    httpx (1.7.6)
-      http-2 (>= 1.1.3)
     json (2.19.5)
     keccak (1.3.3)
-    konstructor (1.0.2)
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
-    mini_portile2 (2.8.9)
-    openssl (3.3.2)
     parallel (2.1.0)
     parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
-    pkg-config (1.6.5)
     prism (1.9.0)
     public_suffix (7.0.5)
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.4.2)
-    rbsecp256k1 (6.0.0)
-      mini_portile2 (~> 2.8)
-      pkg-config (~> 1.5)
-      rubyzip (~> 2.3)
     regexp_parser (2.12.0)
     rexml (3.4.4)
     rspec (3.13.2)
@@ -104,10 +60,6 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
-    rubyzip (2.4.1)
-    scrypt (3.1.0)
-      ffi-compiler (>= 1.0, < 2.0)
-      rake (~> 13)
     simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
@@ -146,47 +98,22 @@ DEPENDENCIES
 CHECKSUMS
   addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
   ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
-  base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
   bigdecimal (3.3.1) sha256=eaa01e228be54c4f9f53bf3cc34fe3d5e845c31963e7fcc5bedb05a4e7d52218
-  bls12-381 (0.3.1) sha256=d1525cd319c53f14178d54f355dfe1b4c572fbf5625965c1afccdc425b9896dc
   crack (1.0.1) sha256=ff4a10390cd31d66440b7524eb1841874db86201d5b70032028553130b6d4c7e
   diff-lcs (1.6.2) sha256=9ae0d2cba7d4df3075fe8cd8602a8604993efc0dfa934cff568969efb1909962
   docile (1.4.1) sha256=96159be799bfa73cdb721b840e9802126e4e03dfc26863db73647204c727f21e
-  ecdsa (1.2.0) sha256=b8f7c9541b6c587cbe37e705a1b76be6dc1e85336aa23ac3cf2f07b038bcec55
-  eth (0.5.17) sha256=5be9caa85b0643613010ae33c92e746a02ce376a35245e6eb5f491e80531f137
-  ffi (1.17.4) sha256=bcd1642e06f0d16fc9e09ac6d49c3a7298b9789bcb58127302f934e437d60acf
-  ffi (1.17.4-aarch64-linux-gnu) sha256=b208f06f91ffd8f5e1193da3cae3d2ccfc27fc36fba577baf698d26d91c080df
-  ffi (1.17.4-aarch64-linux-musl) sha256=9286b7a615f2676245283aef0a0a3b475ae3aae2bb5448baace630bb77b91f39
-  ffi (1.17.4-arm-linux-gnu) sha256=d6dbddf7cb77bf955411af5f187a65b8cd378cb003c15c05697f5feee1cb1564
-  ffi (1.17.4-arm-linux-musl) sha256=9d4838ded0465bef6e2426935f6bcc93134b6616785a84ffd2a3d82bc3cf6f95
-  ffi (1.17.4-arm64-darwin) sha256=19071aaf1419251b0a46852abf960e77330a3b334d13a4ab51d58b31a937001b
-  ffi (1.17.4-x86-linux-gnu) sha256=38e150df5f4ca555e25beca4090823ae09657bceded154e3c52f8631c1ed72cf
-  ffi (1.17.4-x86-linux-musl) sha256=fbeec0fc7c795bcf86f623bb18d31ea1820f7bd580e1703a3d3740d527437809
-  ffi (1.17.4-x86_64-darwin) sha256=aa70390523cf3235096cf64962b709b4cfbd5c082a2cb2ae714eb0fe2ccda496
-  ffi (1.17.4-x86_64-linux-gnu) sha256=9d3db14c2eae074b382fa9c083fe95aec6e0a1451da249eab096c34002bc752d
-  ffi (1.17.4-x86_64-linux-musl) sha256=3fdf9888483de005f8ef8d1cf2d3b20d86626af206cbf780f6a6a12439a9c49e
-  ffi-compiler (1.4.2) sha256=a9d69d5d9ced6f64776ddafa535867ad90e5740ad37bed7afb4de6e450da126e
-  forwardable (1.4.0) sha256=f1cd40cc9812937980e1c76f1aa053660990a7c9b6a98fc37d945468afcce838
-  h2c (0.2.1) sha256=a53b7dfeb95660c97b615235ea1b29ec8e1856edc571845685682d94b6e8e227
   hashdiff (1.2.1) sha256=9c079dbc513dfc8833ab59c0c2d8f230fa28499cc5efb4b8dd276cf931457cd1
-  http-2 (1.1.3) sha256=1b2f379d35a11dbae94f8a1a52c053d8c161eb4a0c98b5d1605ff1b2bf171c9c
-  httpx (1.7.6) sha256=82d825abc9876a132adc3492c56a0c528478ac238dd6f74d3422ab0036c6b5c8
   json (2.19.5) sha256=218a18553e4801d579ca7e0f5bc72bafd776d7397238a1fb4e74db5b0a812c59
   keccak (1.3.3) sha256=970dcb1e78b8c3129ba2baff8a5baa5cebf391136db1f4018e8ccc9130794557
-  konstructor (1.0.2) sha256=fd6ac9eb1dadc1e520e06042aa2ef0122d6a070e06cde86db5a54c0c7bfe2e31
   language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
-  mini_portile2 (2.8.9) sha256=0cd7c7f824e010c072e33f68bc02d85a00aeb6fce05bb4819c03dfd3c140c289
-  openssl (3.3.2) sha256=7f4e01215dc9c4be1fca71d692406be3e6340b39c1f71a47fea9c497decd0f6c
   parallel (2.1.0) sha256=b35258865c2e31134c5ecb708beaaf6772adf9d5efae28e93e99260877b09356
   parser (3.3.11.1) sha256=d17ace7aabe3e72c3cc94043714be27cc6f852f104d81aa284c2281aecc65d54
-  pkg-config (1.6.5) sha256=33f9f81c5322983d22b439b8b672f27777b406fea23bfec74ff14bbeb42ec733
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
   public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
   racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
   rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
   rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
-  rbsecp256k1 (6.0.0) sha256=d38f563bfc6bcf3ce20c336a4798cc6990427f291e74c6817360363a72f11669
   regexp_parser (2.12.0) sha256=35a916a1d63190ab5c9009457136ae5f3c0c7512d60291d0d1378ba18ce08ebb
   rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
   rspec (3.13.2) sha256=206284a08ad798e61f86d7ca3e376718d52c0bc944626b2349266f239f820587
@@ -197,12 +124,10 @@ CHECKSUMS
   rubocop (1.86.1) sha256=44415f3f01d01a21e01132248d2fd0867572475b566ca188a0a42133a08d4531
   rubocop-ast (1.49.1) sha256=4412f3ee70f6fe4546cc489548e0f6fcf76cafcfa80fa03af67098ffed755035
   ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33
-  rubyzip (2.4.1) sha256=8577c88edc1fde8935eb91064c5cb1aef9ad5494b940cf19c775ee833e075615
-  scrypt (3.1.0) sha256=67fde35bc7e3b7fe906c5be9c242acf95fe4a886c89572f405f6b11df30aa6af
   simplecov (0.22.0) sha256=fe2622c7834ff23b98066bb0a854284b2729a569ac659f82621fc22ef36213a5
   simplecov-html (0.13.2) sha256=bd0b8e54e7c2d7685927e8d6286466359b6f16b18cb0df47b508e8d73c777246
   simplecov_json_formatter (0.1.4) sha256=529418fbe8de1713ac2b2d612aa3daa56d316975d307244399fa4838c601b428
-  siwe-rb (0.1.2)
+  siwe-rb (0.3.0)
   unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90

data/README.md

@@ -1,6 +1,6 @@
 # siwe-rb
 
-Sign-In with Ethereum (EIP-4361) for Ruby — message construction, parsing, and signature verification, with built-in support for ERC-1271 and EIP-6492 smart contract wallets.
+Sign in with Ethereum (EIP-4361) for Ruby — message construction, parsing, and signature verification, with built-in support for ERC-1271 and EIP-6492 smart contract wallets.
 
 `siwe-rb` is the Ruby companion to the [TypeScript](https://github.com/signinwithethereum/siwe), [Python](https://github.com/signinwithethereum/siwe-py), and [Rust](https://github.com/signinwithethereum/siwe-rs) implementations under the [@signinwithethereum](https://github.com/signinwithethereum) organisation. It runs against the same shared test-vector suite.
 
@@ -8,19 +8,27 @@ Sign-In with Ethereum (EIP-4361) for Ruby — message construction, parsing, and
 
 ```ruby
 # Gemfile
-gem "siwe-rb", "~> 0.1"
+gem "siwe-rb", "~> 0.3.0"
 ```
 
 ```ruby
 require "siwe"
 ```
 
-Requires Ruby ≥ 3.3.
+Requires Ruby ≥ 3.3 with OpenSSL secp256k1 support. The only external runtime
+dependency is `keccak`; verification does not require `eth` or `rbsecp256k1`.
+
+For hosts that install gems with `--ignore-dependencies` (including Discourse
+plugins), install and activate `keccak` before `siwe-rb`.
 
 ## Usage
 
 ### Construct and sign a message
 
+Signing is usually performed by the user’s wallet. This Ruby signing example
+uses the optional `eth` gem, which you must add to your own Gemfile to run it.
+`siwe-rb` itself only verifies signatures.
+
 ```ruby
 require "siwe"
 require "eth"
@@ -91,6 +99,16 @@ config     = Siwe::Config.new(rpc: custom_rpc)
 message.verify!(signature: sig, domain: domain, nonce: nonce, config: config)
 ```
 
+### Crypto adapters
+
+The default adapter is `Siwe::Adapter::OpenSSL`. Custom adapters still implement
+`verify_message(message, signature)` and return the recovered EIP-55 address.
+Raise `Siwe::Crypto::SignatureError` for a bad signature so verification can try
+the smart-wallet fallback; unexpected exceptions propagate to the caller.
+
+Version 0.3 removes `Siwe::Adapter::EthGem`. Applications that sign with `eth`
+must declare it themselves; ordinary verification callers need no API changes.
+
 ### Error handling
 
 All failures raise (or, for `verify`, surface as `response.error`) a single `Siwe::Error` carrying a `type` symbol from `Siwe::ErrorType`:
@@ -140,4 +158,4 @@ SIWE_RPC_URL=https://ethereum-rpc.publicnode.com bundle exec rspec --tag live_rp
 
 ## License
 
-MIT or Apache-2.0, at your option.
+MIT.

data/lib/siwe/adapter.rb

@@ -1,33 +1,18 @@
 # frozen_string_literal: true
 
-require "eth"
-
-require_relative "error"
-require_relative "error_type"
+require_relative "crypto"
 
 module Siwe
   module Adapter
-    # Default crypto adapter using the eth gem.
-    # Implements the SiweConfig interface from the TS reference implementation:
-    # verify_message → recover signer address from EIP-191 signed message
-    # hash_message → EIP-191 personal_sign hash
-    # get_address → normalize to EIP-55 checksum address
-    class EthGem
+    # Recover the signer using Ruby's OpenSSL bindings and Keccak.
+    # A custom adapter implements #verify_message(message, signature), returns
+    # an EIP-55 address, and raises Crypto::SignatureError for invalid signatures.
+    class OpenSSL
       def verify_message(message, signature)
-        public_key = Eth::Signature.personal_recover(message, signature)
-        Eth::Util.public_key_to_address(public_key).to_s
-      end
-
-      def hash_message(message)
-        prefixed = Eth::Signature.prefix_message(message)
-        Eth::Util.keccak256(prefixed)
-      end
-
-      def get_address(addr)
-        Eth::Address.new(addr).to_s
+        Crypto.recover_address(message, signature)
       end
     end
 
-    DEFAULT = EthGem.new
+    DEFAULT = OpenSSL.new
   end
 end

data/lib/siwe/config.rb

@@ -3,48 +3,36 @@
 require_relative "adapter"
 
 module Siwe
-  # Verification config — pluggable adapter (crypto), RPC URL or RPC client (smart wallet),
-  # and optional verification fallback.
+  # Verification config — pluggable adapter (crypto) plus RPC URL or RPC client
+  # for the smart-wallet (ERC-1271 / ERC-6492) verification path.
   #
   # Set globally via Siwe.configure { |c| ... } or per-call as `verify(config: ...)`.
   class Config
-    attr_reader :rpc_url, :rpc, :adapter, :verification_fallback
+    attr_reader :rpc_url, :rpc, :adapter
 
-    def initialize(rpc_url: nil, rpc: nil, adapter: nil, verification_fallback: nil)
+    def initialize(rpc_url: nil, rpc: nil, adapter: nil)
       @rpc_url = rpc_url
       @rpc = rpc
       @adapter = adapter || Siwe::Adapter::DEFAULT
-      @verification_fallback = verification_fallback
     end
 
     def to_h
-      {
-        rpc_url: @rpc_url,
-        rpc: @rpc,
-        adapter: @adapter,
-        verification_fallback: @verification_fallback
-      }
+      { rpc_url: @rpc_url, rpc: @rpc, adapter: @adapter }
     end
 
     # Mutable struct used inside Siwe.configure { |c| c.rpc_url = ... }.
     # Caller mutates fields, then build returns a frozen Config.
     class Builder
-      attr_accessor :rpc_url, :rpc, :adapter, :verification_fallback
+      attr_accessor :rpc_url, :rpc, :adapter
 
-      def initialize(rpc_url: nil, rpc: nil, adapter: nil, verification_fallback: nil)
+      def initialize(rpc_url: nil, rpc: nil, adapter: nil)
         @rpc_url = rpc_url
         @rpc = rpc
         @adapter = adapter
-        @verification_fallback = verification_fallback
       end
 
       def build
-        Config.new(
-          rpc_url: @rpc_url,
-          rpc: @rpc,
-          adapter: @adapter,
-          verification_fallback: @verification_fallback
-        )
+        Config.new(rpc_url: @rpc_url, rpc: @rpc, adapter: @adapter)
       end
     end
   end

data/lib/siwe/crypto.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require "digest/keccak"
+require "openssl"
+
+module Siwe
+  # Ethereum cryptographic and encoding helpers. Signature recovery handles
+  # only public inputs and uses Ruby's OpenSSL bindings for secp256k1 operations.
+  module Crypto
+    module_function
+
+    class SignatureError < StandardError; end
+
+    HEX_ADDRESS = /\A0x[0-9a-fA-F]{40}\z/
+    HEX_SIGNATURE = /\A(?:0[xX])?([0-9a-fA-F]{64})([0-9a-fA-F]{64})([0-9a-fA-F]{2})\z/
+    SECP256K1_ORDER = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
+
+    def keccak256(data)
+      Digest::Keccak.new(256).digest(data)
+    end
+
+    def eip191_hash(message)
+      keccak256("\x19Ethereum Signed Message:\n#{message.bytesize}".b + message.b)
+    end
+
+    def recover_address(message, signature)
+      public_key = recover_public_key(eip191_hash(message), signature)
+      checksum_address("0x#{bin_to_hex(keccak256(public_key.byteslice(1, 64)).byteslice(-20, 20))}")
+    end
+
+    def recover_public_key(digest, signature)
+      raise SignatureError, "digest must be exactly 32 bytes" unless digest&.bytesize == 32
+
+      r, s, parity = parse_signature(signature)
+      group = OpenSSL::PKey::EC::Group.new("secp256k1")
+      recovery_point = recovery_point(group, r, parity)
+      order = group.order
+      # ECDSA recovery: Q = r^-1 * (sR - zG).
+      digest_integer = digest.unpack1("H*").to_i(16)
+      signed_recovery_point = recovery_point.mul(OpenSSL::BN.new(s.to_s))
+      inverse_message_point = group.generator.mul(OpenSSL::BN.new((-digest_integer % SECP256K1_ORDER).to_s))
+      inverse_r = OpenSSL::BN.new(r.to_s).mod_inverse(order)
+      public_key = signed_recovery_point.add(inverse_message_point).mul(inverse_r)
+      raise SignatureError, "could not recover a valid secp256k1 public key" if public_key.infinity?
+
+      public_key.to_octet_string(:uncompressed)
+    rescue OpenSSL::PKey::EC::Point::Error => e
+      raise SignatureError, e.message
+    end
+
+    def parse_signature(signature)
+      # eth historically accepted raw 65-byte signatures as well as hex.
+      signature = bin_to_hex(signature) if signature.is_a?(String) && signature.bytesize == 65
+      match = HEX_SIGNATURE.match(signature.to_s.b)
+      raise SignatureError, "signature must be exactly 65 bytes" unless match
+
+      r, s, recovery = match.captures.map { |hex| hex.to_i(16) }
+      unless r.positive? && r < SECP256K1_ORDER && s.positive? && s < SECP256K1_ORDER
+        raise SignatureError, "signature values are outside the secp256k1 scalar field"
+      end
+
+      [r, s, recovery_id(recovery)]
+    end
+    private_class_method :parse_signature
+
+    def recovery_point(group, scalar, recovery_id)
+      # personal_sign has one parity bit; its x coordinate is r. OpenSSL
+      # decompresses and validates the point (secp256k1 has cofactor 1).
+      encoded = [2 + recovery_id].pack("C") + [scalar.to_s(16).rjust(64, "0")].pack("H*")
+      point = OpenSSL::PKey::EC::Point.new(group, OpenSSL::BN.new(encoded, 2))
+      raise SignatureError, "signature recovery point is not on secp256k1" unless point.on_curve?
+
+      point
+    end
+    private_class_method :recovery_point
+
+    def checksum_address(address)
+      return nil unless HEX_ADDRESS.match?(address.to_s)
+
+      hex = remove_hex_prefix(address).downcase
+      hash = bin_to_hex(keccak256(hex))
+      checksummed = hex.chars.each_with_index.map do |character, index|
+        character.match?(/[a-f]/) && hash[index].to_i(16) >= 8 ? character.upcase : character
+      end.join
+      "0x#{checksummed}"
+    end
+
+    def abi_encode_validator_args(address, digest, signature)
+      raise ArgumentError, "invalid Ethereum address" unless HEX_ADDRESS.match?(address.to_s)
+      raise ArgumentError, "digest must be 32 bytes" unless digest&.bytesize == 32
+
+      signature_bytes = hex_to_bin(signature)
+      address_word = remove_hex_prefix(address).downcase.rjust(64, "0")
+      digest_word = bin_to_hex(digest)
+      offset_word = 96.to_s(16).rjust(64, "0")
+      length_word = signature_bytes.bytesize.to_s(16).rjust(64, "0")
+      padded_signature = bin_to_hex(signature_bytes).ljust(((signature_bytes.bytesize + 31) / 32) * 64, "0")
+
+      "#{address_word}#{digest_word}#{offset_word}#{length_word}#{padded_signature}"
+    end
+
+    def hex_to_bin(hex)
+      normalized = remove_hex_prefix(hex.to_s)
+      unless normalized.length.even? && normalized.match?(/\A[0-9a-fA-F]*\z/)
+        raise ArgumentError, "invalid hexadecimal value"
+      end
+
+      [normalized].pack("H*")
+    end
+
+    def bin_to_hex(binary)
+      binary.unpack1("H*")
+    end
+
+    def remove_hex_prefix(value)
+      value.start_with?("0x", "0X") ? value[2..] : value
+    end
+
+    def recovery_id(value)
+      case value
+      when 0, 1 then value
+      when 27, 28 then value - 27
+      # Preserve eth.rb's historical default-chain behavior for EIP-155-style
+      # v values, even though personal_sign normally emits 0/1 or 27/28.
+      when 37, 38 then value - 37
+      else
+        raise SignatureError, "invalid signature recovery byte #{value}"
+      end
+    end
+    private_class_method :recovery_id
+  end
+end

data/lib/siwe/eip6492.rb

@@ -10,9 +10,6 @@ module Siwe
     # 32-byte magic suffix appended to EIP-6492 wrapped signatures.
     MAGIC_SUFFIX = "6492649264926492649264926492649264926492649264926492649264926492"
 
-    # ERC-1271 magic value returned by `isValidSignature(bytes32,bytes)`.
-    EIP1271_MAGIC_VALUE = "1626ba7e"
-
     # Off-chain universal signature validator. Deployed via eth_call (no actual
     # deployment) to verify EOA, ERC-1271, and EIP-6492 signatures in one call.
     #

data/lib/siwe/message.rb

@@ -10,7 +10,7 @@ require_relative "response"
 require_relative "util"
 
 module Siwe
-  # An EIP-4361 Sign-In with Ethereum message.
+  # An EIP-4361 Sign in with Ethereum message.
   # Construct via `Siwe::Message.new(**fields)` or parse via `Siwe::Message.parse(string)`.
   # Render via `#prepare_message` (alias `#to_eip4361`, `#to_s`).
   class Message
@@ -156,7 +156,9 @@ module Siwe
 
     def check_temporal!(time_str)
       check_at = time_str ? Time.iso8601(time_str) : Time.now.utc
-      if @expiration_time && Time.iso8601(@expiration_time) < check_at
+      # `expiration-time` is the instant the message becomes invalid (ERC-4361). Reject at
+      # the boundary too — matches TS/Python/Rust which all use check_time >= expiration.
+      if @expiration_time && Time.iso8601(@expiration_time) <= check_at
         raise Error.new(ErrorType::EXPIRED_MESSAGE, expected: @expiration_time, received: check_at.iso8601)
       end
       return unless @not_before && Time.iso8601(@not_before) > check_at
@@ -167,22 +169,40 @@ module Siwe
     end
 
     def check_signature!(signature, cfg)
-      if signature.nil? || signature.empty?
-        raise Error.new(ErrorType::INVALID_SIGNATURE, expected: "non-empty signature", received: signature.inspect)
+      if signature.nil? || signature.to_s.empty?
+        raise Error.new(ErrorType::INVALID_PARAMS, expected: "non-empty signature", received: signature.inspect)
       end
 
       recovered = recover_eoa(signature, cfg)
       return if recovered && recovered.downcase == @address.downcase
 
+      # EOA recovery also accepts binary signatures. Contract signatures use
+      # hex of arbitrary byte length, including zero. Reject malformed hex
+      # here so the ABI encoder cannot leak an ArgumentError from #verify.
+      unless signature.is_a?(String) && signature.b.match?(/\A(?:0[xX])?(?:[0-9a-fA-F]{2})*\z/)
+        raise Error.new(ErrorType::INVALID_SIGNATURE, expected: "hex-encoded signature", received: signature.inspect)
+      end
+
       # EOA recovery failed or address mismatch — try smart-wallet path if configured.
       return if smart_wallet_valid?(signature, cfg)
 
       raise Error.new(ErrorType::INVALID_SIGNATURE, expected: @address, received: recovered.to_s)
     end
 
+    # Errors specific to signature recovery failures. Other
+    # exceptions (e.g. an adapter raising on misconfiguration, network errors)
+    # are intentionally not rescued — they signal programmer error or transport
+    # failure, not "this signature is bad".
+    EOA_RECOVERY_ERRORS = [
+      Crypto::SignatureError,
+      ArgumentError,
+      TypeError
+    ].freeze
+    private_constant :EOA_RECOVERY_ERRORS
+
     def recover_eoa(signature, cfg)
       cfg.adapter.verify_message(prepare_message, signature)
-    rescue StandardError
+    rescue *EOA_RECOVERY_ERRORS
       nil
     end
 
@@ -201,11 +221,24 @@ module Siwe
       nil
     end
 
+    # ERC-4361 requires ERC-1271 verification to happen on the chain matching the
+    # message's `Chain ID`. We refuse to fall back to the smart-wallet path unless
+    # the RPC reports a chain id and it matches. A custom RPC client that does not
+    # expose chain_id must add it; a silent skip here would let an attacker validate
+    # against any chain a misconfigured RPC happens to be pointed at.
     def check_chain_id_match!(rpc)
-      return unless rpc.respond_to?(:chain_id)
+      unless rpc.respond_to?(:chain_id)
+        raise Error.new(ErrorType::INVALID_SIGNATURE_CHAIN_ID,
+                        expected: @chain_id.to_s,
+                        received: "rpc client does not expose chain_id")
+      end
 
       rpc_chain = rpc.chain_id
-      return if rpc_chain.nil? || rpc_chain == @chain_id
+      if rpc_chain.nil?
+        raise Error.new(ErrorType::INVALID_SIGNATURE_CHAIN_ID,
+                        expected: @chain_id.to_s, received: "nil")
+      end
+      return if rpc_chain == @chain_id
 
       raise Error.new(ErrorType::INVALID_SIGNATURE_CHAIN_ID,
                       expected: @chain_id.to_s, received: rpc_chain.to_s)

data/lib/siwe/parser.rb

@@ -10,18 +10,17 @@ module Siwe
   # Returns a hash of typed fields plus an array of non-fatal warnings.
   class Parser
     HEADER_SUFFIX = " wants you to sign in with your Ethereum account:"
-    SCHEME_REGEX  = /\A([A-Za-z][A-Za-z0-9+\-.]*)\z/
-    # RFC 3986 authority (without scheme://) — userinfo, host (reg-name/IPv4/IP-literal), port.
-    DOMAIN_REGEX  = /\A[A-Za-z0-9\-._~%!$&'()*+,;=:@\[\]]+\z/
+    SCHEME_REGEX  = Util::SCHEME_REGEX
     ADDRESS_REGEX = /\A0x[0-9a-fA-F]{40}\z/
     NONCE_REGEX   = /\A[A-Za-z0-9]{8,}\z/
     CHAIN_REGEX   = /\A[0-9]+\z/
-    # Statement chars per ABNF: %d32-33 %d35-36 %d38-59 %d61 %d63-64 %d91 %d93 %d95 %d126.
-    # Note: explicitly excludes %d34 (") and %d37 (%). Built via Regexp.new to avoid
-    # accidental string interpolation of `#$&` inside a regex literal.
+    # ERC-4361 statement = reserved / unreserved / " " per RFC 3986. The regex unions
+    # ALPHA + DIGIT with the punctuation in those sets; excludes LF, ", %, and other
+    # characters outside RFC 3986. Built via Regexp.new to avoid accidental string
+    # interpolation of `#$&` inside a regex literal.
     STATEMENT_REGEX = Regexp.new('\A[a-zA-Z0-9 !\x23\x24\x26-\x3B\x3D\x3F\x40\x5B\x5D\x5F\x7E]*\z')
-    REQUEST_ID_REGEX = %r{\A[A-Za-z0-9\-._~%!$&'()*+,;=:@/?]*\z}
-    URI_REGEX = /\A[A-Za-z][A-Za-z0-9+\-.]*:[^\s]*\z/
+    # request-id = *pchar per ABNF — no "/" or "?".
+    REQUEST_ID_REGEX = Util::PCHAR_REGEX
 
     def self.parse(str)
       new(str).parse
@@ -46,7 +45,7 @@ module Siwe
 
       statement = parse_statement_block(lines[2...uri_idx])
 
-      uri        = parse_field(lines[uri_idx],     "URI: ",       :invalid_uri,             URI_REGEX)
+      uri        = parse_uri_field(lines[uri_idx], "URI: ")
       version    = parse_field(lines[uri_idx + 1], "Version: ",   :invalid_message_version, /\A1\z/)
       chain_str  = parse_field(lines[uri_idx + 2], "Chain ID: ",  :unable_to_parse,         CHAIN_REGEX)
       nonce      = parse_field(lines[uri_idx + 3], "Nonce: ",     :invalid_nonce,           NONCE_REGEX)
@@ -101,7 +100,7 @@ module Siwe
 
     private
 
-    def parse_header(line) # rubocop:disable Metrics/AbcSize
+    def parse_header(line)
       raise unable_to_parse("missing header") if line.nil? || line.empty?
       raise unable_to_parse("malformed header") unless line.end_with?(HEADER_SUFFIX)
 
@@ -112,22 +111,22 @@ module Siwe
         scheme, _, domain = prefix.partition("://")
         raise unable_to_parse("invalid scheme: #{scheme.inspect}") unless SCHEME_REGEX.match?(scheme)
         raise unable_to_parse("empty domain") if domain.empty?
-        unless DOMAIN_REGEX.match?(domain)
-          raise Error.new(ErrorType::INVALID_DOMAIN, expected: "RFC 3986 authority",
-                                                     received: domain)
-        end
 
+        validate_domain!(domain)
         [scheme, domain]
       else
-        unless DOMAIN_REGEX.match?(prefix)
-          raise Error.new(ErrorType::INVALID_DOMAIN, expected: "RFC 3986 authority",
-                                                     received: prefix)
-        end
-
+        validate_domain!(prefix)
         [nil, prefix]
       end
     end
 
+    def validate_domain!(domain)
+      return if Util.valid_authority?(domain) && !domain.empty?
+
+      raise Error.new(ErrorType::INVALID_DOMAIN, expected: "RFC 3986 authority",
+                                                 received: domain)
+    end
+
     def parse_address(line)
       raise unable_to_parse("missing address line") if line.nil?
       unless ADDRESS_REGEX.match?(line)
@@ -188,12 +187,22 @@ module Siwe
       value
     end
 
+    def parse_uri_field(line, prefix)
+      raise unable_to_parse("missing #{prefix.strip}") if line.nil?
+      raise unable_to_parse("expected #{prefix.strip} line") unless line.start_with?(prefix)
+
+      value = line[prefix.length..]
+      raise Error.new(ErrorType::INVALID_URI, expected: "RFC 3986 URI", received: value) unless Util.valid_uri?(value)
+
+      value
+    end
+
     def parse_resources(lines, start_idx)
       idx = start_idx
       out = []
       while idx < lines.length && lines[idx].start_with?("- ")
         uri = lines[idx][2..]
-        unless URI_REGEX.match?(uri)
+        unless Util.valid_uri?(uri)
           raise Error.new(ErrorType::INVALID_URI, expected: "RFC 3986 resource URI", received: uri)
         end
 

data/lib/siwe/rpc.rb

@@ -25,6 +25,11 @@ module Siwe
         @timeout = timeout
       end
 
+      # Returns the chain id (Integer). Lazy-fetched via eth_chainId on first call and
+      # cached for the lifetime of this client. Raises Siwe::Error :rpc_error on probe
+      # failure rather than returning nil — callers in the smart-wallet path rely on
+      # this to enforce ERC-4361's chain binding (a silent nil could otherwise validate
+      # a signature against the wrong chain).
       def chain_id
         @chain_id ||= fetch_chain_id
       end
@@ -41,10 +46,7 @@ module Siwe
       private
 
       def fetch_chain_id
-        hex = rpc_request("eth_chainId", [])
-        hex.to_i(16)
-      rescue Error
-        nil
+        rpc_request("eth_chainId", []).to_i(16)
       end
 
       def rpc_request(method, params)

data/lib/siwe/smart_wallet.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "eth"
+require_relative "crypto"
 
 require_relative "eip6492"
 require_relative "error"
@@ -23,14 +23,11 @@ module Siwe
     # Returns true (valid) or false (validator returned non-1).
     # Re-raises Siwe::Error from the rpc client on transport errors.
     def verify(rpc:, address:, message:, signature:) # rubocop:disable Naming/PredicateMethod
-      hash_hex = bin_to_hex(eip191_hash(message))
+      digest = eip191_hash(message)
       sig_hex = strip_hex_prefix(signature)
 
-      args = Eth::Abi.encode(
-        %w[address bytes32 bytes],
-        [address, Eth::Util.hex_to_bin(hash_hex), Eth::Util.hex_to_bin(sig_hex)]
-      )
-      data = "0x#{Eip6492::VALIDATOR_BYTECODE}#{Eth::Util.bin_to_hex(args)}"
+      args = Crypto.abi_encode_validator_args(address, digest, sig_hex)
+      data = "0x#{Eip6492::VALIDATOR_BYTECODE}#{args}"
 
       result = rpc.eth_call(to: nil, data: data)
       result_indicates_valid?(result)
@@ -38,8 +35,7 @@ module Siwe
 
     # Hash a message per EIP-191 (`personal_sign`). Returns binary keccak256.
     def eip191_hash(message)
-      prefixed = Eth::Signature.prefix_message(message)
-      Eth::Util.keccak256(prefixed)
+      Crypto.eip191_hash(message)
     end
 
     # Validator returns 0x01 (possibly zero-padded to 32 bytes) for valid,

data/lib/siwe/util.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
 
+require "ipaddr"
 require "securerandom"
 require "time"
 require "date"
-require "eth"
+require_relative "crypto"
 
 module Siwe
   module Util
@@ -23,6 +24,20 @@ module Siwe
       \z
     /x
 
+    # Character classes per RFC 3986. Anything outside these is rejected.
+    # unreserved + sub-delims + pct-encoded marker, used in reg-name.
+    HOST_CHAR_REGEX     = /\A(?:[A-Za-z0-9\-._~!$&'()*+,;=]|%[0-9A-Fa-f]{2})*\z/
+    USERINFO_CHAR_REGEX = /\A(?:[A-Za-z0-9\-._~!$&'()*+,;=:]|%[0-9A-Fa-f]{2})*\z/
+    # pchar = unreserved / pct-encoded / sub-delims / ":" / "@". Used for request-id
+    # (ABNF "request-id = *pchar") and segments within a path.
+    PCHAR_REGEX = /\A(?:[A-Za-z0-9\-._~!$&'()*+,;=:@]|%[0-9A-Fa-f]{2})*\z/
+    # path = *( pchar / "/" ). No "?" or "#".
+    PATH_REGEX = %r{\A(?:[A-Za-z0-9\-._~!$&'()*+,;=:@/]|%[0-9A-Fa-f]{2})*\z}
+    # query / fragment = *( pchar / "/" / "?" ).
+    QUERY_FRAGMENT_REGEX = %r{\A(?:[A-Za-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9A-Fa-f]{2})*\z}
+    PORT_REGEX   = /\A\d*\z/
+    SCHEME_REGEX = /\A[A-Za-z][A-Za-z0-9+\-.]*\z/
+
     def generate_nonce
       SecureRandom.alphanumeric(NONCE_LENGTH)
     end
@@ -43,12 +58,10 @@ module Siwe
     end
 
     def valid_address?(addr)
-      return false if addr.nil? || addr.empty?
-
-      Eth::Address.new(addr)
-      true
-    rescue StandardError
-      false
+      case address_case(addr)
+      when :lower, :upper, :checksum then true
+      else false
+      end
     end
 
     def address_case(addr)
@@ -63,9 +76,114 @@ module Siwe
     end
 
     def checksum_address(addr)
-      Eth::Address.new(addr).to_s
-    rescue StandardError
-      nil
+      Crypto.checksum_address(addr)
+    end
+
+    # Validate an RFC 3986 authority: [userinfo "@"] host [":" port].
+    # Used for both the SIWE `domain` field and any URI's authority component.
+    # Empty authority is valid (empty reg-name).
+    def valid_authority?(str)
+      return false if str.nil?
+      return true if str.empty?
+
+      userinfo, host_port = str.include?("@") ? str.split("@", 2) : [nil, str]
+      return false if userinfo && !USERINFO_CHAR_REGEX.match?(userinfo)
+
+      host, port = split_host_port(host_port)
+      return false if host.nil?
+      return false if port && !PORT_REGEX.match?(port)
+
+      valid_host?(host)
+    end
+
+    # Validate an absolute RFC 3986 URI: scheme ":" hier-part [ "?" query ] [ "#" fragment ].
+    def valid_uri?(str)
+      return false if str.nil? || str.empty?
+
+      scheme, rest = str.split(":", 2)
+      return false if rest.nil?
+      return false unless SCHEME_REGEX.match?(scheme)
+
+      m = rest.match(/\A(?<hier>[^?#]*)(?:\?(?<query>[^#]*))?(?:\#(?<frag>.*))?\z/)
+      return false if m.nil?
+      return false unless valid_hier_part?(m[:hier])
+      return false if m[:query] && !QUERY_FRAGMENT_REGEX.match?(m[:query])
+      return false if m[:frag]  && !QUERY_FRAGMENT_REGEX.match?(m[:frag])
+
+      true
+    end
+
+    # host = IP-literal / IPv4address / reg-name. Distinguishes by leading "[".
+    def valid_host?(host)
+      if host.start_with?("[") && host.end_with?("]")
+        valid_ip_literal?(host[1..-2])
+      else
+        HOST_CHAR_REGEX.match?(host)
+      end
+    end
+
+    # IP-literal = IPv6address / IPvFuture (latter is rare and unused in SIWE — reject).
+    def valid_ip_literal?(content)
+      return false if content.nil? || content.empty?
+      return false if content.start_with?("v", "V") # IPvFuture not supported
+
+      ipv6 = content
+      if content.include?(".")
+        last_colon = content.rindex(":")
+        return false if last_colon.nil?
+
+        ipv4 = content[(last_colon + 1)..]
+        return false unless valid_dotted_ipv4?(ipv4)
+
+        # IPAddr rejects leading zeros in IPv4 octets ("zero-filled ambiguous"), but the
+        # SIWE test vectors treat them as valid. Rewrite the IPv4 tail as two h16 groups.
+        octets = ipv4.split(".").map(&:to_i)
+        g1 = format("%x", (octets[0] << 8) | octets[1])
+        g2 = format("%x", (octets[2] << 8) | octets[3])
+        ipv6 = "#{content[0..last_colon]}#{g1}:#{g2}"
+      end
+
+      IPAddr.new(ipv6).ipv6?
+    rescue IPAddr::InvalidAddressError
+      false
+    end
+
+    def valid_dotted_ipv4?(addr)
+      octets = addr.split(".", -1)
+      return false unless octets.length == 4
+
+      octets.all? { |o| o.match?(/\A\d{1,3}\z/) && o.to_i <= 255 }
+    end
+
+    def split_host_port(str)
+      if str.start_with?("[")
+        close = str.index("]")
+        return [nil, nil] if close.nil?
+
+        host = str[0..close]
+        rest = str[(close + 1)..]
+        if rest.empty?
+          [host, nil]
+        elsif rest.start_with?(":")
+          [host, rest[1..]]
+        else
+          [nil, nil]
+        end
+      elsif (colon = str.rindex(":"))
+        [str[0...colon], str[(colon + 1)..]]
+      else
+        [str, nil]
+      end
+    end
+
+    def valid_hier_part?(hier)
+      if hier.start_with?("//")
+        rest = hier[2..]
+        authority_end = rest.index("/") || rest.length
+        valid_authority?(rest[0...authority_end]) && PATH_REGEX.match?(rest[authority_end..])
+      else
+        PATH_REGEX.match?(hier)
+      end
     end
   end
 end

data/lib/siwe/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Siwe
-  VERSION = "0.1.2"
+  VERSION = "0.3.0"
 end

data/lib/siwe.rb

@@ -10,6 +10,7 @@ module Siwe
   autoload :Parser,      "siwe/parser"
   autoload :Message,     "siwe/message"
   autoload :Config,      "siwe/config"
+  autoload :Crypto,      "siwe/crypto"
   autoload :Adapter,     "siwe/adapter"
   autoload :Rpc,         "siwe/rpc"
   autoload :SmartWallet, "siwe/smart_wallet"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: siwe-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.3.0
 platform: ruby
 authors:
 - EthID.org
@@ -10,25 +10,19 @@ cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: eth
+  name: keccak
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.11
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.5.11
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.3'
 description: EIP-4361 message construction, parsing, and signature verification, with
   built-in support for ERC-1271 and EIP-6492 smart contract wallets.
 email:
@@ -46,6 +40,7 @@ files:
 - lib/siwe.rb
 - lib/siwe/adapter.rb
 - lib/siwe/config.rb
+- lib/siwe/crypto.rb
 - lib/siwe/eip6492.rb
 - lib/siwe/error.rb
 - lib/siwe/error_type.rb
@@ -56,7 +51,6 @@ files:
 - lib/siwe/smart_wallet.rb
 - lib/siwe/util.rb
 - lib/siwe/version.rb
-- siwe-rb.gemspec
 homepage: https://github.com/signinwithethereum/siwe-rb
 licenses:
 - MIT
@@ -79,7 +73,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.16
 specification_version: 4
-summary: Sign-In with Ethereum (EIP-4361) for Ruby
+summary: Sign in with Ethereum (EIP-4361) for Ruby
 test_files: []

data/siwe-rb.gemspec

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "lib/siwe/version"
-
-Gem::Specification.new do |spec|
-  spec.name    = "siwe-rb"
-  spec.version = Siwe::VERSION
-  spec.authors = ["EthID.org"]
-  spec.email   = ["jalil@ethfollow.xyz"]
-
-  spec.summary = "Sign-In with Ethereum (EIP-4361) for Ruby"
-  spec.description = "EIP-4361 message construction, parsing, and signature verification, " \
-                     "with built-in support for ERC-1271 and EIP-6492 smart contract wallets."
-  spec.homepage    = "https://github.com/signinwithethereum/siwe-rb"
-  spec.license = "MIT"
-  spec.required_ruby_version = ">= 3.3"
-
-  spec.metadata["homepage_uri"] = spec.homepage
-  spec.metadata["source_code_uri"] = spec.homepage
-  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
-  spec.metadata["rubygems_mfa_required"] = "true"
-
-  spec.files = Dir.chdir(File.expand_path(__dir__)) do
-    `git ls-files -z`.split("\x0").reject do |f|
-      f == __FILE__ ||
-        f.start_with?("spec/", "test/", "features/", "bin/", "gems/", "script/") ||
-        f.match?(/\A\.(?:git|github|rubocop|ruby-version|rspec)/)
-    end
-  end
-  spec.require_paths = ["lib"]
-
-  spec.add_dependency "eth", ">= 0.5.11", "< 1.0"
-end