Suppose we had a decentralized log of messages, i.e., an ever-growing array of information on which anyone could append arbitrary data to. Given such primitive, could a party broadcast authenticated messages using just hash functions? Here is what I have in mind:
1. Register
To start submitting authenticated messages, one must first introduce himself by logging an unsigned message:
pvtKey = uint256.random() // random 256-bit string
pubKey = hash256(pvtKey) // 256-bit hash function
LOG("REG" + pubKey)
In other words, just logg the hash of the private key. User then waits the LOG above to be globally confirmed (i.e., permanently and irreversibly stored on the decentralized log; that'd be 6 block confs if using Bitcoin, for example).
2. Prepare a message
Before submitting a message, the user must prepare it as follows:
newPvtKey = uint256.random()
newPubKey = hash256(newPvtKey)
msg = "some arbitrary string"
pre = hash256(pvtKey + newPubKey + msg)
LOG("PRE" + pre)
User then waits the log above to be globally confirmed.
3. Submit the message
LOG("SUB" + pvtKey + newPubKey + msg)
Now, every user takes hash256(pvtKey + newPubKey + msg)
. This is found to be equal to pre
, as submitted on the 2nd log. Every user then takes hash256(pvtKey)
, which is equal to pubKey
, as submitted on the 1st log. Every user then concludes the owner of the first pubKey
signed msg
. To sign a new message, the user repeats steps 2 and 3 using his new pub/pvt key pairs.
Does this scheme work?