10

This has become a bit of a thought experiment for me.

Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between the name and the key?

Generally, PGP keys are for real people, whose identity can be verified IRL, but that does not apply here.

My first original thought was that the pseudonym could be a name based on the key fingerprint, but then, depending on number of characters, it could be quite easy to generate a new key that also meets this requirement.

Could there be a strategy (potentially more social then technological) for someone to verify this correspondence?

Edit:

The potential purpose for a pseudonym with this requirement could be along the same lines as Satoshi Nakamoto, or a whistle blower. Wanting to constantly release documents or software that is verifiably from the owner of the pseudonym.

7

The challenge with pseudonymous keys isn't only about anonymity; there is the additional problem of your identity being non-unique and harder to prove. Considering your pseudonym/nickname as established (that is, you are using an existing identity, rather than making up a new identity based on a hash or something among these lines), your nickname alone is not enough in asserting your identity and reputation.

If your nickname is Sam, if your friend's nickname is Sam, and if both of you have a "trusted" pseudonymous key, then neither of you can shout at the other and tell him, "hey, you're not the real Sam!"

One solution would be to regroup all information about your online identities in some unique place (where you tell "I am Sam on StackExchange", "I own the samlanning.com domain and website", and so on), and then get several people to verify and confirm all these identities. I can think of two ways of doing that:

  1. Join a website such as Keybase (or make/host your own), which does exactly what I described, and is based on OpenPGP. Although internal, all those "central unique identities" make a web of trust, for identities/pseudonyms. A profile looks like this (yes, even the main author of GnuPG uses this website).

  2. Using OpenPGP (and especially GnuPG), find people who are willing to sign (certify) pseudonymous keys, comply with their personal way of verifying your pseudonymous identity, and request them to incorporate policy URLs and notation data in their certifications.

I personally do this when I certify other people's keys:

gpg --ask-cert-level \
     --cert-policy-url http://diti.me/pgp/\#policy \
     --cert-notation CD42FF00@diti.me=http://diti.me/pgp/certs/%f.notes.asc \
     --sign-key

A policy URL is an URL (here, Internet document) inside of which you describe to the world what your OpenPGP key certification policy is. The person signing your pseudonymous key should tell (in this document) that they actually certify pseudonymous keys, and how.

A key notation is arbitrary text of the form key=value. The OpenPGP specification doesn't actually specify what uses should implementations make of these, but one use for them is to put an URL as the value. But you may simply have the signer put some text like "I carefully checked Sam's pseudonymous identity" if you want.

Using my command above, you can see that, on keyservers, both policy URLs and notation data are displayed by default:

sig  sig1  CD42FF00 2014-04-07 __________ __________ []
    Policy URL: http://diti.me/pgp/#policy
    Notation data: CD42FF00@diti.me http://diti.me/pgp/certs/A31D4F81EF4EBD07B456FA04D2BB0D0165D0FD58.notes.asc

For the record, this is me signing CAcert.org's automated GPG signing key, and I'll leave here a Web Archive link to the notation data.

For as long as the notation data produced by the signer can be read, anyone can/may decide whether or not they trust your pseudonymous identity. Using these, any motivated person willing to carefully check how reputable and trustable your pseudonym is, can actually do so.

EDIT: Actually, I think I might have gone a little off-topic in point 2. Is your question only about the pseudonymous certification process, or also its auditing?

  • Thanks for the comprehensive answer, and yes it was more about the auditing process. – Sam Lanning May 29 '14 at 17:03
1

After speaking with some friends a bit more, we may have come up with a candidate solution.

Given that what we are trying to avoid is someone impersonating the original keyholder, we don't want someone to be able to generate a new keypair, re-sign everything the original person did, and claim they own the same pseudonym.

You could use a distributed time-stamping system to prove that an association between the pseudonym and public key existed at a specific time (namely the time that the pseudonym was created). For example https://www.btproof.com/

People could then consider this as proof enough that the association is valid, and choose to sign the UID.

0

After reading about this problem and finding out about Bicoin timestamping, I came up with a relatively simple way to make yourself a way to prove that you are the owner of a pseudonymous ID using a PGP key and a Bitcoin address in your ownership. This system relies on the fact that in order to unlock these two things you require a secret which, in principle, is posesssed by you and only you.

  1. Create a PGP key pair.
  2. Create a Bitcoin address on your client. Backup the wallet belonging to this address or you won't be able to authenticate yourself anymore!
  3. Perform Bitcoin timestamping on your key as per [this page here][1]. Basically, this amounts to the following:
    1. Take the SHA256 hash of your key's fingerprint.
    2. Convert it into a syntactically valid Bitcoin address.
    3. Send a small payment, 10 US dollar cents worth of BTC will do, from the address you created to the address you constructed out of the hash of your key's fingerprint. The Bitcoins will disappear, because the payment was sent to an address that cannot be unlocked by any private key. However, because the address is syntactically valid, the transaction will pass and this will publish to the blockchain, which is shared by every single thick client on the Bitcoin network, a message saying that when block X was appended to the blockchain at time T, address 1YouR0wn4dRESS sent N bitcoins to address 1SHA256sUm0fY0urkEYf1NG3rPr1nT.
  4. Finally, put the details of your timestamping transaction on the information fields of your private key (e.g. create a new key ID and on the user name field put something like "Timestamped with 0.0005 BTC sent from 1YouR0wn4dRESS to 1SHA256sUm0fY0urkEYf1NG3rPr1nT") and upload your key to a keyserver.

To have someone validate your identity, follow this protocol:

  1. Have the verifier send you an encrypted message using your public key, in which he asks you to send a small payment to an address chosen by the authenticator.
  2. Decrypt the message with your private key. This will prove that you're the owner of the private part of the key.
  3. Send the payment from 1YouR0wn4dRESS to the address the authenticator sent you. This will prove that you are the owner of the private key required to spend the funds of the wallet associated with address 1YouR0wn4dRESS.
  4. Just for additional cred, you can have the authenticator look up your timestamping transaction on, say, blockchain.info

Successful completion of step 3 can only be achieved if you are in possession of the private key that unlock messages sent to you using your public key, because you need it to read the payment instructions. The payment can only be completed if you own the private key that unlocks the wallet with address 1YouR0wn4dRESS, which got to the blockchain when you timestamped your key's fingerprint. You are now authenticated.

  • Do you mean "Bitcoin timestamping"? – Ebenezar John Paul Aug 5 '14 at 5:36
  • 1
    I don't think this really goes any way towards proving an association between a pseudonym and a public key at any point in time, what id does proove however is an association between a bitcoin address and a PGP public key (if you upload a signed message from your PGP key pointing to the bitcoin address) – Sam Lanning Aug 5 '14 at 9:26
  • It will definitely not prove association with an alias. What it will prove is that you are the person who is supposed to be behind a given alias. An impostor will be able to seize your username, but won't be able to authenticate himself because he doesn't have neither the timestamped key nor the address used to timestamp it. – Echelon-1 Aug 5 '14 at 21:28
  • Out of interest, is there no way to translate (even offline) one's PGP private key into a bitcoin wallet key, which could then have cents sent to it? There's still that mathematically provable connection, right? Or is there no way to prove that a given e.g., RSA public key is associated with a given Bitcoin wallet address? Just, it would be nice to be able to extract said "10 cents" at a later time IYKWIM – JamesTheAwesomeDude Nov 25 '17 at 19:24
-2

My first original thought was that the pseudonym could be a name based on the key fingerprint, but then, depending on number of characters, it could be quite easy to generate a new key that also meets this requirement.

If the fingerprint is based on a sufficiently strong one-way hash function then it should be computationally infeasible to generate another key that also produces the same result, but the pseudonym would need to be similar in length to the hash output as reducing it to something more memorable will greatly increase the ease of producing collisions.

  • 1
    I think this answer would be better off as a comment. – Diti May 29 '14 at 12:28
  • precisely, a 128-character pseudonym is unrealistic, so we would need to reduce it, hence highly increasing the chance of a collision. – Sam Lanning May 29 '14 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.