0

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone.

Usually these aren't high-effort attacks, just email address spoofing, etc. These often go something like this:

  • An early-career author writes/fabricates a paper.
  • They find a respected researcher, and create a confusingly similar email account.
  • They add the respected researcher's name to the paper as first author and themselves as second author.
  • They contact the journal as the respected author.

This is super annoying - retracting a paper from the record is a huge headache. On the other hand, academia seems like the perfect place for things like key signing parties, what with the scientific conferences and whatnot.

I'd like to try to sign things I might publish, so that the journal can quickly authenticate that the listed author has actually written the paper and is the one communicating with them.

Is this a good idea (or even possible)? I'm quite a novice to the X.509/PGP/GPG world; I wonder if anyone could point me to any precedent and best practices for this specific application? For instance, arXiv requires the raw latex source, so simply signing a .pdf with an X.509 cert is a non-starter.

The academic world has also adopted the ORCiD identifier as a unique reference key for each researcher (to avoid name changes from breaking citations, etc, but not for authentication). Would it be a good idea to include this in the signature somehow?

(note that I'm not actually a scientist [yet] - I might be mistaken about these issues!)

6
  • Adobe PDF has the ability to sign PDFs...
    – schroeder
    Sep 21 at 13:10
  • ORCiD becomes your key. You publish papers under the "Works" section of your profile. From the ORCiD site: "Our Founding Principles ORCID will work to support the creation of a permanent, clear, and unambiguous record of research and scholarly communication by enabling reliable attribution of authors and contributors."
    – schroeder
    Sep 21 at 13:12
  • @schroeder I guess this question is too open-ended, sorry. You're right, the ORCiD does provide some kind of index where publications can be looked up once published (a trusted institution webpage would fulfill the same lookup function), but the iD itself is not designed to authenticate (anyone can sign up under anyone's name, there's no auth process). I'm more interested in the case where a journal wants to authenticate the researcher pre-publication.
    – 0xDBFB7
    Sep 21 at 13:56
  • @schroeder Thanks for the suggestion - signing a .pdf doesn't seem like a viable option because many venues don't accept pdfs. I guess hashing the plaintext would be a possible alternative?
    – 0xDBFB7
    Sep 21 at 14:00
  • Uh ... so how is a "signing party" going to help when you want the publisher to verify? How is signing supposed to help? Anything you are hoping to get from a certificate (which does not require authentication) you get from ORCiD. ORCiD is, in fact, the solution to the problem you have identified. You want a trusted identity that can be publicly validated but open for anyone to use. Without a central registry, that's going to be difficult,.
    – schroeder
    Sep 21 at 14:41
0

It seems to me that timestamping is just as important as signing in your case.

For example, you can write a paper in 2021 and sign it. A dishonest person can then steal your paper in 2023, then also sign it. You have no way to prove that you were in possession of the paper before the dishonest person was, or that your signature predated the dishonest person's signature.

What you need is a way to prove that the paper existed in 2021, and was signed using a private key that only you know.

One way to do this is to use the bitcoin blockchain as your 'notary'. Create a bitcoin private key and address. Then, take a hash of your paper, and include the hash in a bitcoin transaction, which you then sign with your private bitcoin key. This way, the hash of the paper will be stored in the bitcoin blockchain in perpetuity, and will be associated with a bitcoin address that is tied to your private key, which only you know.

Then, at a later time, if needed, you can prove:

a) That the paper existed at the point in time that the transaction was made (by virtue of the timestamp on the block that includes the transaction, which includes the hash of the paper).

b) That you had possession of the paper at that time (by virtue of the fact the transaction is associated with an address for which only you have the corresponding private key).

Finally, this procedure does not require you to disclose the paper, as only the hash of the paper (and not the paper itself) is published.

2
  • Great answer, these types of hashed timestamping systems are indeed very important. The most common system for lab notebooks is the RFC3161 standard for Time Stamping Authorities. For establishing priority for papers, nowadays the usual tactic is to preprint the whole paper.
    – 0xDBFB7
    Sep 22 at 17:19
  • I should have made more clear in the question the type of attack I wanted the signature to protect against, will edit.
    – 0xDBFB7
    Sep 22 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.