How PDAs prevent unauthorized accounts from signing it?

Question

As far as I can understand, PDAs are a way for programmatically signing for an address without actually having a private key. The process of generating a new PDA is calculating sha256 hash of program_id + seeds + bump and check whether the result is a valid public key (does it reside on the curve?), if it's not a valid public key (thus no corresponding private key exists) it's our newly generated PDA, otherwise decrement the bump and try again.

The thing that I can't grasp is that, at the end, this process will generate an address-like string (or maybe an actual address, I don't know) but how does the program who owns this PDA prove that it is the true owner of the PDA? And how does it prevent adversaries from forging the signature?

Answer 1

How does the program who owns this PDA prove that it is the true owner of the PDA

Because the program ID is part of the inputs to the hash function. If you swap it for any other program ID you'll get a completely different output (PDA). A property of the hash function is that nobody can compute a different program ID that will hash (with any set of seeds) to the same PDA.

And how does it prevent adversaries from forging the signature?

Remember that there isn't a private key here, that's what it means for it to be off the curve. I don't actually know the technical details here, but I can explain how this would work.

When a program wants to write to a PDA, it would provide the seeds/bump and the derived address. The runtime can easily verify that the requesting program ID, and those seeds/bump, hash to the derived address. If they don't then it can reject the request.

If any other program tried to write to the same PDA, it wouldn't be able to provide seeds/bump that hash to the requested address when combined with its program ID.