I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the hash.
More specifically: Alice has a large file (
data). She creates:
- a hash of
- a hash of (
data+ some message (e.g. her ID)) = Y
Both are public. Now Bob only has X (the hash of
data), Y, and her ID (but not the data itself). He has to be able to confirm that Y was created using the data, but he should not be able to create Y without access to the data.
I guess what I want can be approximated by deriving a key pair from
data and signing the ID with it (X would be the public key, and Y would be the signed ID). The problem with this idea is that someone else could precompute the private key, and pass only that to Alice. She then could compute Y without ever seeing the data. I'd like to require that Alice has to have the full data to create Y.
In particular Alice doesn't need to prove that she still has the data. It suffices to show that she had it at one point in time. The resulting protocol should be non-interactive, i.e. Alice publishes X, Y and ID and then someone can verify that they fit. I also don't need to protect information from Bob. He knows the hash X, and in principle can use it to lookup the data somewhere. It's just really inconvenient for him, so the protocol should allow verification of Y with only X and ID. If he could use the full data and ID to verify Y, then this would be a plain old digital signature.
This scheme I'm looking for seems like something that should already exist and have a name, and I don't want to MacGuyver my own crypto if not neccessary.