Alice wants to send Bob messages. She has the following requirements.

  1. She plans to send him messages that are sequentially numbered, pseudonymous, and sent to him publicly over a period of time.
  2. Each message will take the form of a single text file.
  3. She wants Bob (and indeed anyone else who is interested) to be able to verify soon after he receives each message that it is from the same sender as all previous messages, but right now she does not want him know that she is that person.
  4. She wants to be able to prove at a later date, if she feels like it, that she is that person.
  5. She does not trust online key servers.
  6. She does not trust sites such as 4chan.
  7. She wants to start by publishing a PGP RSA-1 fingerprint publicly, e.g. perhaps she will get it into a photograph in a large-circulation hardcopy newspaper and then make it "common knowledge" that that edition contained the right fingerprint.
  8. She wants that fingerprint to be as short as possible but long enough not to be hackable, meaning that nobody else can feasibly make a key pair in which the public key has the same fingerprint.
  9. She does not want to be defeated by Chuck. Chuck is a bad guy who will certainly read the genuine messages and who is capable of sending fake messages to Bob. For example Chuck may try to swamp Alice's messages by sending Bob fake messages (perhaps a large number of them)
    a) through the same public channel as genuine messages,
    b) that purport to be in the sequence,
    c) that are divided into three parts just like genuine messages,
    d) that have a content quite close to the "kind of thing" that Alice would write, but have subtle differences that serve Chuck's wicked purposes,
    e) that use a public key with a fingerprint that is as close to Alice's fingerprint as Chuck can get, and
    f) that verify as legitimate using a public key (included in his messages) that has that fingerprint.

How should Alice proceed?

In particular, what length of public key and password will be sufficient? Am I right that the answers are "4096 bits" and "40 characters"? And will the following advice included in each genuine message be sufficient?


This document is in three parts: P (main text), Q (public key), and R (signature). To verify its authenticity, take the following steps.

  • A. Retrieve the 40-character fingerprint X from [presumed unfakeable place, e.g. a certain issue of a printed newspaper]

  • B. Create a text file, copy Q into it as its entire content, and save it as "Q.asc".

  • C. Use a PGP program to find the fingerprint Y of Q.

  • D. Verify that X = Y. If it does not, this message is fake. If and only if it does, take the next three steps.

  • E. Create a second text file, copy P into it as its entire content, and save it as "P.txt" in the same folder as "Q.asc".

  • F. Create a third text file, copy R into it as its entire content, and save it as "R.asc" in the same folder as "P.txt" and "Q.asc".

  • G. Use a PGP program to verify that R is the authentic signature of P using the public key Q. If it is, and if you are sure that X=Y, then this document is authentic. Otherwise, it is fake.

These verification instructions would be included in the "main text" of each message, i.e. part P.

Maybe there's a less complicated way she can do this?

  • This really looks like a homework question. Is it? If not, can you explain the purpose for a brand new implementation and the ultimate goal?
    – schroeder
    Mar 6, 2021 at 13:48
  • You have a lot of weird and unnecessary requirements without explanation: "She does not trust sites such as 4chan." -- what's the relevance? "She wants that fingerprint to be as short as possible" -- why? And your whole threat model for "Chuck" makes a ton of assumptions that defeat anything you've come up as a mitigation, else you have not explained the relevant details about the threat Chuck poses. "divided into three parts" -- that's a new detail without antecedent. "close fingerprints" -- what does that even mean and how is it relevant?
    – schroeder
    Mar 6, 2021 at 13:55
  • "what length of public key and password will be sufficient?" - nothing you've described so far will help answer that. So we can't comment on whether you are correct in your assumptions.
    – schroeder
    Mar 6, 2021 at 13:57
  • No, it's not a homework question. The purpose is personal enlightenment. The relevance of not trusting 4chan is that unless I am mistaken it's possible to post messages there which carry a unique authorial ID. I read that somewhere. If it's not so, I'll remove that bit.
    – user252311
    Mar 6, 2021 at 13:57
  • You don't trust cryptographic key servers, but you trust a newspaper? Can you explain the disparity in trust?
    – schroeder
    Mar 6, 2021 at 13:59