I am trying to design an algorithm for publicly sharing authenticated messages.
Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep track of a lengthy asymmetric key. Instead, I only want users to keep track of a password that can be hashed to make the keys that they need. All other information is shared publicly.
I hope to achieve this using an elaborate scheme involving HMACs where the HMAC keys are released after the message has been successfully signed and published. An attacker can't fake a message, because he would only be able to sign and publish a message after the corresponding HMAC key has been released.
The real author needs to prove that the HMAC key they used is the correct HMAC key. To do this they must publish a hash (or HMAC) of the HMAC key beforehand, so when they share the HMAC key it can be authenticated as well.
So it basically will work like this:
- Alice wants to publicly share authenticated messages using only a secret password.
- She generates an initial HMAC key using her password.
- She publishes the hash of that HMAC key so that it can be later verified.
Later, when she wants to publish a message she does the following:
- Uses her password and a counter to generate a replacement HMAC key and a hash of that replacement HMAC key.
- uses the previous HMAC key to sign the message she wants to publish.
- uses the previous HMAC key to sign the hash of the replacement HMAC key.
- shares the signed message and the signed hash of the replacement HMAC key.
- Once both have been published, she shares the previous HMAC key itself.
- Everyone else uses the previously published HMAC key hash to verify the HMAC key is correct.
- They then use that HMAC key to authenticate the message and replacement HMAC key.
I would appreciate some feedback on the security implications of my invented scheme if you have time to thoroughly understand the described algorithm.
This is my best attempts to create a scheme for publicly authenticating messages using only a password. What I would really like to know is if there is a viable way to do this.
I have become convinced that the best alternative is to have users who don't want to keep track of a lengthy private key use a trusted third party service that stores an encrypted version of that key. When they want to sign a message, they download their encrypted key from that service, decrypt it, and then sign their message the normal way. If I could do better I'd like to know.