3

Although this question may be out of scope, I'm wondering if there's a reliable way to apply a "digital signature" to real life objects in order to prove your ownership of them to a degree.

As an example, let's assume I bought my own office chair for the workplace, and it may be physically indistinguishable from the others. I'd like to print a "tag" or "signature" and stick it to a hidden spot on the chair. If the situation ever arises that I have to provide some sort of proof that the chair is my own, what should that tag contain? Is my name or a random word sequence good enough? Or could I make it more sound by leveraging asymmetric cryptography somehow?

  • 5
    The problem for physical assets is the same for digital assets: how do you determine that you only tagged the one chair and you had the right to tag any chair at all? There needs to be authorisation at the time of tagging. At that point, you use the same process that's been used for centuries: you register ownership with a central authority. – schroeder Feb 17 at 16:16
  • If you hide the tag, the tag can still be discovered, changed, or destroyed. – schroeder Feb 17 at 16:18
  • I'm just reiterating what schroeder said, but imagine it from the other side. Pretend you had a way to "tag" a physical device to mark it as your own. What is to stop me from sneaking into your office while you are out, tagging your chair as my own, and then accusing you of theft? Marking something as yours is, comparatively, the easy part. – Conor Mancone Feb 17 at 17:49
  • @ConorMancone i'm being optimistic and try to rule out malicious intent, instead focusing on a way to prove ownership. However, i guess security measures mechanisms pretty much imply the possibility of malicious intent, so it doesn't make much sense to rule it out of the discussion indeed. – Gabriel S. Feb 17 at 19:07
  • @GabrielS. if that were the case you can go for the simple classic - write your name on it with a permanent marker. I don't think any fancier methods will do much better than that... – Conor Mancone Feb 17 at 19:16
1

You are not actually asking to apply a signature to a real life object but you are only asking how to create a signature which can be associated with you and with nobody else. What then happens with this signature is another thing: you can attach it to the object you own or you can attach it to an object you don't actually own. Others can remove the signature, copy the signature, put it somewhere else or destroy it. Thus the actual use of such a digital signature in real life is limited.

Still, you can create such a signature if you have a digital identity based in public key cryptography and where the identity is accepted by others. This can for example be a smartcard, a PGP key, an S/MIME certificate etc. All these allow you to sign something and that's actually all you need: for example you can sign a description of the item with it.

But again, real ownership cannot be proven this way. It would be different though if the items you want to mark already have a unique identification, like a serial number you can find in car chassis or bike frames. In this case the act of ownership transfer could be digitally signed, i.e. the vendor digitally signs a contract which transfers ownership to you and if you give the item away you also sign such a contract for ownership transfer. This way nobody can just claim something as its own but must actually prove how they got it by showing the contract. In reality this gets way more complex than that but this is the basic idea.

|improve this answer|||||
1

I will share an experience that MAY have little to do with InfoSec and might also be flawed, but it was the best method we knew on that time. It may also include obscurity, known to be controversial.

At the school I used to go, we had a lot of problems with property (belongings) and we had to deal with them. By this, we could have anything stolen by anyone; from pencils, expensive pens, cases to backpacks and clothing. So I learned to be very careful on the unique details of any object I owned and at the same time, nobody would expect I use those details for fingerprinting. For example, wooden pencils may have small bumps; my backpack had ink spilled on a dark material, so nobody could notice that it was spilled and also it had a small piece of thread inside.

What I did was taking a timestamped photo to this details at the exact first moment I bought it with the bill containing it’s time (not for pencils but for more expensive stuff like a Parker pen), so I could show it when someone tried to take it from me.

This is obscurity, because if someone finds it, he may destroy that proof or modify it (but he still doesn’t know if it IS the detail I’m considering, as there are so many). And let’s also consider there are some native features of an object that nobody can modify or destroy unless they destroy the object.

And what happened if someone took a photo of a detail I haven’t yet seen? I had the time and moment of when I bought it that matches the bill.

And what if someone faked a bill along with the time of the photo? We could simply go to a store and check it on the system.

Details were the key.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.