Prove control of a Lightning node key with a one-time challenge
For a support handover, a verifier can ask the node operator to sign a fresh challenge and compare the signer with the expected public key.
Sign a scoped challenge
Agree on the exact challenge text in MESSAGE, including the purpose, expiry and a random nonce. On the claimant's node, sign the text and return the zbase signature to the verifier.
lightning-cli signmessage "$MESSAGE" | jq -r .zbase
lightning-cli checkmessage "$MESSAGE" "$SIGNATURE" "$EXPECTED_KEY"
Verify against the expected identity
Run the second command on the verifier's Core Lightning node with the known EXPECTED_KEY. Compare the verified key with the enrolled identity and consume the nonce once. A signature authenticates the exact text and key. It does not prove a particular channel balance or transfer any funds.
docs.corelightning.org signmessage · docs.corelightning.org checkmessage