1

Hypothetically, I'd like to demonstrate that I am the owner of a piece of published information. The requirements are the following.

  • The hash/ characteristic string is compact enough (ideally a few bytes, say 16 or 32.)
  • It does not expose my identity in the first place. In other words, if someone just looks at the signature/hash/characteristic string, they should not be able to deduce who wrote the message.
  • Easily verifiable. Upon request from someone, the owner (and only the owner) of a private key can perform the signing again to reproduce the same hash/ characteristic string. S/he will prove the ownership of the message only when s/he wants to.

Let me elaborate a little bit. Suppose I publish a message -- let's say it's a regular text file of 2 KB for the sake of argument. I can gpg sign it and publish the signature together with the main text. With an RSA key and --clearsign I get ~500 bytes signature. However, it has a few issues.

First of all, in an extreme scenario this is too many characters (say I want to write it down on a small piece of paper.)

Also, it exposes my identity unnecessarily. My original goal is to show that I am the owner of a message only upon request, yet the PGP signature contains the information of who signed it in an unprotected way.

In addition, the verification needs to be done through gpg. During validation gpg takes the signature as the input to verify the authenticity. Therefore, it's not a one-way verification process. By that I mean I cannot show that I am the owner simply by signing again. If I sign again, the PGP signature will not be the same since the sining date and time changes. This prevents me from hashing the signature with MD5 or SHA-256 since the signature (and the hash) is not stable. If I repeat the process again I don't end up with the same MD5/SHA256 hash.

I'm pretty sure this has already been discussed thoroughly in cryptography/hash. I would appreciate it if someone could point me to the right direction(s). Cheers.

P.S. of course this assumes no trust is put into the original author as well. Otherwise I can just MD5 hash the full message + an author name in the end. This immediately meets all requirements. However, the original author could be lying about the author name in the first place. Instead, I would like to prove that the owner of a secret (private key, password, etc.) is the owner of the aforementioned published message.

9
  • "perform the signing again to reproduce the same hash" - This does not proof ownership of the private key. Anybody who has access to the hash which should be verified can return this hash without redoing the actual signature. What could be done instead is to ask for the public key for the signature, check with the public key if the signature matches and then challenge the owner of the key to sign another random message with the same key to prove ownership of the private key. Anyway, off-topic here and on-topic on Cryptography May 4, 2023 at 16:32
  • 1
    OP, you might want to consider taking a MD5 or SHA256 hash of the message, then including the hash in a bitcoin transaction, where it will remain immutable perpetually. If/when there comes a time when you want to 'claim ownership' of the document, simply prove that you have possession of the private key that was used to sign the transaction (one way to do this is to create another transaction using the same private key). See security.stackexchange.com/questions/220247/… for more info.
    – mti2935
    May 4, 2023 at 16:40
  • 1
    @mti2935 thanks for the interesting idea. The linked question is very similar to the scenario I'm imagining. Now suppose I don't need proof of existence before a certain time. I guess what I can do is to 1) sign 2) hash the signature 3) include the hash in the IP and release them together. If the hash is preserved during propagation of the information (i.e. assume the majority of the society respects ownership of IP) in the future I can choose to reveal the signature. Then all I need to do is to show that I'm the owner of the private key.
    – Boson Bear
    May 4, 2023 at 22:07
  • 1
    @BosonBear Generally, a digital signature does not include the public key needed to verify the signature. Even if it did, the public key is not tied to your identity, unless you do something (such as requesting a certificate, or registering the key on a key server) to cause that. Please see my answer below for more info.
    – mti2935
    May 6, 2023 at 20:20
  • 1
    Actually, I take back 'Generally, a digital signature does not include the public key needed to verify the signature'. For ECDSA signatures, it seems that it is possible to extract the public key from the signature. See crypto.stackexchange.com/questions/18105/… for some interesting reading on this.
    – mti2935
    Jun 18, 2023 at 15:34

2 Answers 2

1

One way to achieve your objective is to use a digital signature. You could simply create a keypair, use the private key to sign the IP, then append the signature (64 bytes if you use ECDSA) to the IP. This would allow you to remain anonymous until you choose to disclose that you are the author, because others would have no way of linking the signature to you. If/when you choose to disclose, you simply publish the public key, and prove that you are in possession of the private key (which you can do by using it to sign another message). Then, others can verify that the private key was indeed used to sign the IP.

However, thinking about this more, there may be a simpler way to achieve your objective, which would require you to append fewer bytes to the message:

  1. Create a hash of the IP (let's call this H1)

  2. Create a large (256 bit) random number (let's call this R)

  3. Create a hash of R (let's call this H2)

  4. Concatenate H1 and H2, then take a hash of (H1 | H2) (let's call this H3)

  5. Append H3 to the IP (32 bytes if you use SHA256)

Only someone with knowledge of R would be able to follow the steps above, and arrive with H3. When it comes to to disclose, you simply reveal R.

3
  • 1
    Yeah it's a good point that the public key doesn't necessarily lead to the person as long as it was not published in the first place. I made an assumption that the PGP public key was already on the keyserver but you're right it doesn't have to. As for the alternative you proposed the only drawback I can see is that it can only be used once. By that I mean as long as I release R everyone will know it hence it loses its capacity of validating the ownership. It's still a neat alternative though.
    – Boson Bear
    May 7, 2023 at 21:01
  • 1
    After giving it some thought I see a minor shortcoming in the proposed method (if I could nitpicking, that is.) The newly created key pair is not recognized until the holder reveals the ownership. This is actually a double edged sword: it saves the trouble of hashing the sig, but it also allows a bigger chance of the private key being transferred from one person to another between the time of the IP creation and the moment the ownership is declared. If hash of sig is used, when the identity is revealed people can check the stability of the private key owership e.g. through WoT or keyserver.
    – Boson Bear
    May 29, 2023 at 20:07
  • 1
    But given that my question was about the "shortest" message needed to claim ownership, I think this is the best method I've seen.
    – Boson Bear
    May 29, 2023 at 20:08
0

You can simply use a cryptographic hash

For example you could summarize the message:

I, Henry I, king of the English, son of William the Conqueror, to Bishop Samson and Urso de Abetot and all his barons and faithful, both French and English, of Worcestershire, greeting.

Know that by the mercy of God and the common counsel of the barons of the whole kingdom of England I have been crowned king of said kingdom; and because the kingdom had been oppressed by unjust exactions, I, through fear of god and the love which I have toward you all, in the first place make the holy church of God free, so that I will neither sell nor put ot farm, nor on the death of archbishop or bishop or abbot will I take anything from the church's demesne or from its men until the successor shall enter it. And I take away all the bad customs by which the kingdom of England was unjustly oppressed; which bad customs I here set down in part:

If any of my barons, earls, or others who hold of me shall have died, his heir shall not buy back his land as he used to do in the time of my brother,but he shall relieve it by a just and lawful relief. Likewise also the men of my barons shall relieve their lands from their lords by a just and lawful relief.

using sha256 to just 420892c94c7b458deab323325f568724a72b97cf5f57054624711882f8cd45a7

Upon request, you can reveal the actual text, from which anyone could confirm that it matches the previously published value 420892c94c7b458deab323325f568724a72b97cf5f57054624711882f8cd45a7, but just with the hash value it's not possible to find any text leading to such hash. Even less so you you wanted the body of the Charter to be the same but with a different king name.

You could either embed the contents as text (your 2 KB file) or a hash of it.

You mention

However, the original author could be lying about the author name in the first place. Instead, I would like to prove that the owner of a secret (private key, password, etc.) is the owner of the aforementioned published message.

but that's not really different. You can simply embed the public key in the message. For example:

My name is Satoshi Nakamoto
I am the author of the paper “Bitcoin: A Peer-to-Peer Electronic Cash System”
The hash of this document is b1674191a88ec5cdd733e4240a81803105dc412d6c6708d53ab94fc248f4f553

My PGP key is:
-----BEGIN PGP PUBLIC KEY BLOCK-----

mI0ESQzjUgEEALU8vb4pavO2ejb7mUHWYvdYZtUI5hl7fOEdiLp9kwVriWVCY2Bm
i+ugnD1zLy3+okKtXPZthQcJicwicMFgRx7NtZo8dIg9S8XM1N87fTS1NjEwkmUO
tPYdE5NbQmR7dtwisatxHRrlwFO3q7eyjVGzXyg/2RXkQGDyBs7rRpo7ABEBAAG0
I1NhdG9zaGkgTmFrYW1vdG8gPHNhdG9zaGluQGdteC5jb20+iNQEEwEKAD4WIQQ9
I/CXeznLowAXsMozYi29S295nwUCSQzjUgIbAwUJJZgGAAULCQgHAgYVCgkICwIE
FgIDAQIeAQIXgAAKCRAzYi29S295nxHnA/0VOn9uibkid26Y/rrOXXMXOnHrUpqp
4W96BzlsZJ5ESdaLjW/kJN7aAO1GlRW3m7PiOLV+zSNNSxO2hWaL4dL05rycpTDq
VoKSx8uT5DFzjfe9tj4RRfOLfrsPl6qgl59e6JQShMLC/4bVbqF6+Yu7FElkZdam
N3gEQgmhF2gncA==
=dl1M
-----END PGP PUBLIC KEY BLOCK-----

We don't know if the above name Satoshi Nakamoto is an alias or a real name. But if the hash of this text had been published previously to the bitcoin paper being known, this reveals whoever wrote that message knew about the bitcoin paper (it could be the author, a friend, or even someone that reviewed it), and the above public key is linked to the person that wrote this message.

1
  • I agree that inserting the name and inserting the public key is the same, since both names and pubkeys are public knowledge. In both cases the author could be lying. However, I wanted to embed a signature instead of a public key before hash the whole thing. That way I can at least (in the future choose to) show that the author owned the private key at the time of writing. Modulo the case of key being stolen etc., in the future one can just establish the ownership of the IP by showing the ownership of the private key, right?
    – Boson Bear
    May 6, 2023 at 2:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .