How to prove flyer was (not) authored by specific person?

Question

Let's say we create a flyer in some desktop publishing software (e.g., InDesign, Illustrator), physically print it and post it somewhere.

We don't want inauthentic claims of authorship.

Is there a way to, say, put a [?] on the flyer that only we could have generated. Or, that someone claiming to author the flyer cannot prove they generated. (We are fine in revealing ourselves if we have to prove we generated it, it's more to defend against others claiming they did.)

Or should it be a message that no-one can decrypt?

This might be a simple public key problem, but if someone could list specifics of how we'd do it, it'd be much appreciated!

Answer 1

With a digital signature you might claim ownership of a piece of data, but usually not to your own advantage. A digital signature works like this:

• The key owner generates a public/private key pair (two mathematical objects sharing a common structure).
• The public key is made public (hence the name) while the private key is kept private (the structure is such that revealing the public key does not allow recovery of the private key).
• A signature is computed over a given piece of data using the signature generation algorithm, which relies on the private key.
• A signature value can be verified over the piece of data, using the signature verification algorithm and the public key.

The signature somehow proves that the owner of the private key was involved in the process since knowledge of the private key is needed to produce a signature value that the verification algorithm will accept. The signature value is mathematically tied to the data that was signed, and thus cannot be transported to another piece of data. Certificates (hence PKI) are a method to bind identities (e.g. your name and physical being) to public keys, so that other people may learn (with some strong guarantee of reliability) what your public key actually is. Certificates themselves rely internally on signatures.

Now this does not really solve your problem. As I wrote, signatures can be used to claim ownership; by signing a piece of data, you demonstrate that you were involved, but nothing prevents you from signing a file which was "produced" (in some way) by somebody else.

The normal way of using signatures is to endorse: by signing something, you accept to be bound (in some way, possibly legally) to the contents of what you signed. That's not what you seek here.

A better candidate is time stamps. Authorship really is defined relatively to time: you are the author of some work because you are the first one to have come about it. So you want a proof of anteriority.

A Time Stamp Authority is some service who signs (with a digital signature) a structure containing the current date and time (as known to the TSA) and a piece of data (actually a hash thereof, but that's a technicality). The TSA, by that signature, guarantees that the piece of data existed at the specified date. So what you want to do is to submit to a TSA a structure which contains your artistic work (the "flyer") and your name; and the TSA will issue a time stamp which proves that, at some date T, the flyer was in your possession.

If you do that before publishing the flyer, then other people will not be able to obtain a time stamp for the same data, with their name, and a date prior to T. If the earliest proof of possession of the flyer bears your name, then you will be reputed the "original owner", i.e. the author.

In practice, what you do is the following:

• Take the artistic work as a file F.
• Create a text file called README.txt with your name in it.
• Put both F and README.txt in a Zip archive.
• Obtain a time stamp from a TSA.
• Keep the time stamp and the Zip archive somewhere. In case of dispute, show them to the judge.

Whether such a scheme would hold in court is another matter. Legal matters are their own world. My technical feeling is that a time stamp done that way is a rather strong proof element, but whether it will be sufficient depends on jurisdiction, local laws, and, crucially, how well the used TSA does its job.

There is a non-computer equivalent to the time stamp; it is called a Soleau envelope. If you take your flyer in printed form, and put that in the Soleau envelope along with a sheet of paper stating your name, then that would be a good start for ulterior authorship claims.

Answer 2

Signing a physical object like a printed poster is problematic at best.

If someone photocopied the poster and re-posted or somewhere else, is it still valid? What if they cropped off the edges of a valid poster? is it still good? How about subtle but semantically significant changes like color or clarity? Does taking a marker to your poster invalidate it?

There is no good way to address these issues in the physical world. Digital assets lend themselves much more readily to digital signatures. So we punt: instead of trying to sign the physical item, link from the printed poster (eg by qr code) to a digital version. Maybe a Web page that contains all the noteworthy details. Location, contents, time, maybe an image of the item itself. All of that signed, time-stamped, whatever you need to do. But the actual poster isn't the signed content. It's a pointer that shows the viewer where he can see and verify the actual signed data.