1

I'm a programmer, and I've made a nifty script that scours a certain internal forum site. Messages posted on the forum are all anonymous, so I'm wondering how exactly I can get my script to realize which of those messages are mine. I have a basic understanding of encryption, and was planning on encrypting my messages with a pre-generated public key, and store a private key in my script.

Unfortunately, in recent light of events, I've realized that the private key can be obtained from the source code, which in turn could be used to generate an equivalent public key, and then used to impersonate me.

How does my open-source script authenticate that a message that was posted, was posted by me?

Constraints: 1) All messages that I post is visible to others, so no secrets can be transmitted to my script. 2) The source code of my script will be open.

6
  • 3
    Have you considered a digital signature?
    – forest
    Commented Dec 7, 2018 at 8:03
  • "... I've realized that the private key can be obtained from the source code ..." - This is a strange assumption. Commonly the private is not part of some source code, i.e. it is in a separate (and maybe passphrase protected) file which will be provided when the private key is needed (for signing, not for validating signature) or even resides on a hardware device (smart card). Commented Dec 7, 2018 at 8:25
  • 1
    Hi Vering, your system is insecure in terms that you have the private key on the source code, try first to fix that and the other steps are easy.
    – camp0
    Commented Dec 7, 2018 at 8:39
  • or try to store your PK in local and read it from disk instead of hard coding it (just saying...) Commented Dec 7, 2018 at 10:37

1 Answer 1

1

If you want to publish your script, then you should do it the other way around: Put the public key into your script and keep the private key to yourself.

Sign your messages with your private key. The script can then be used to verify that those signatures come from you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .