# Transferable ownership certificate

Is there a crytpographic way to assert ownership of an asset (let's say a piece of stone)?

As an example, a number (public key) could be engraved in the stone, and the owner could keep a private key (never shared).

Anyone who wants to claim for ownership would have to decrypt a message, and only the one who has the private key can do it.

But one more thing: the ownership should be transferable. Here is the problem with the previous system: if the owner A sells the object to owner B, owner A could secretely keep the private key when he gives it to owner B.

What are the general cryptographic solutions for this? (except blockchain which is a famous solution nowadays, that I already know)

For the sake of simplicity, I assume that every party can be identified by a keypair (e.g. Alice has a public $A_{p}$ and a secret $A_s$) and every asset by an identifier (a hash for example).

Let us say it is "known" that Alice owns a certain property identified by $P$, either because she created it and registered the identifier somewhere, or she claimed it, or got it from someone else (we don't care). A way that she could transfer the ownership to Bob (with keypair $B_p, B_s$) is to make a statement that is semantically equivalent to:

I, Alice, transfer the ownership of [P] to the person holding the key [B_s].
The current date is [Mon 30 Oct 17:27:18 CET 2017].


She then signs the statement with her private key $A_s$ and gives it to Bob. Then, if anybody contests whether Bob actually owns $P$, he can show the signed statement and thus prove that he owns $P$.

There is only one drawback to this system, which is that Alice could transfer the ownership more than once. This is because she can just write another statement with an invalid date, which looks (as long as we never have seen Bob's statement) to be valid all the same.

Therefore, we will always need to broadcast transfers of ownership. There are multiple ways this can be done. For example, Bob could put the hash of the statement in a widely distributed newspaper. Then he could later point back to prove that the statement indeed existed at the moment the newspaper was printed. To retract this Proof of Existence (PoE) you would need to get your hands on all the prints of the newspaper, which is probably not feasible.

We could (as you mention) also publish the statements in a blockchain (this is what Bitmark does), such that the distributed nature of the blockchain makes it impossible to retract a statement.

A third way is to use a trusted third party. The Time Stamping Protocol defines CA's for signing PoE's for users. On Twitter, you will sometimes see cryptographers publishing proofs of existence for articles/knowledge that they are not (yet) allowed to publish. In this case, Twitter is the trusted third party (because we all trust Twitter not to allow a person to tweet in the past).

• Thanks! If someone contests Bob 's ownership you say he can show the signed statement. But how? Doesn't he need to show the private key to do that? Thanks in advance if you can add a few details about this in the answer. – Basj Nov 1 '17 at 9:03
• We only need to identify Bob. I.e. he must prove that he has the key. For this he does not need to show it. Instead, we could use a challenge-response algorithm. The contester Charlie generates a random nonce and sends it to Bob. Bob signs it and sends it back to Charlie. Using $B_p$, Charlie checks the signature (and the value). If it verifies successfully, he now knows for sure that Bob actually holds $B_p$. – dsprenkels Nov 1 '17 at 9:12

If the rock had a tamper-proof computer in it (say a smart card, a Trezor, an ORWL, etc) which was unfeasible to extract private keys from (maybe it even wipes itself or self-destructs if it senses it's getting taken apart), then that computer could be used to sign a message. If everyone trusts that the computer is physically secure and that the private signing key it uses was securely generated on the device and never left the device, then when A gives B the device, everyone knows that A can no longer sign messages with it and only B can now.

Note that while A had the device, he could have signed messages containing future timestamps. For B to prove to others that B has the device now, B should sign a message that not only contains the present timestamp but also contains a value only knowable to someone on that date or later (such as a recent newspaper headline, recent lottery numbers, and/or the hash of the Bitcoin blockchain's latest block).