Verify a Cardano COSE message signature against the actual challenge
A verifier can correctly validate a signature over the wrong login challenge. Reconstruct the signed structure and separately enforce what the application asked the wallet to sign.
Rebuild the COSE signing bytes
For a COSE_Sign1 response, preserve the original protected-header bytes and payload semantics. Reconstruct the CBOR Sig_structure with the agreed external additional data, then verify the signature using the supplied public key and permitted algorithm.
Sig_structure = [ "Signature1", protected_headers_bytes, external_aad, payload ]
If a server issued nonce N2 but the payload contains N1, a mathematically valid signature for N1 must fail the login. Check domain, expiry and nonce, and bind the public key to the expected address credential under the wallet signing profile.
Handle attached and detached payloads explicitly
An absent embedded payload requires the exact detached payload bytes. If the signing profile supports hashed payloads, apply its advertised rules before comparison. Do not convert signed bytes through a generic text formatter that can alter normalization or line endings. cips.cardano.org Cardano CIP-8