3
$\begingroup$

Alice wishes to publish under a pseudonym a series of texts online. She expects the texts to circulate, and she will not include any way of contacting her. Bob will not know the identity of the pseudonymous author but he will seek to confuse the author's audience by publishing texts that he falsely attributes to the same pseudonymous person. For verification of the authenticity of her writings Alice wishes to use PGP but she does not wish to use a key server. She can only operate online.

Is the following approach sensible?

STAGE A

1) Publish several fairly anodyne initial texts in places that are sufficiently obscure for Bob not to notice for a while, and which are also places of record that date-stamp texts. I'm thinking Usenet here.

2) In each of those texts, include her PGP public key, its 40 hex-digit fingerprint, and a signature made using her PGP private key.

STAGE B

3) Start publishing the texts that Bob will find annoying on open-access websites. In each one, include the said fingerprint, the advice that readers may find her PGP public key in posts that were made to named Usenet groups between two stated dates, and a signature made using her PGP private key.

Bob will now start publishing fake texts. These may state that the author has changed their key and that the new public key is as follows. Or they may state that they have been signed using a key from a pair for which the public key can be found in Usenet articles posted between a different pair of dates.

Alice's idea is that although Bob's actions may be a minor annoyance, she can safely continue publishing texts in the knowledge that the more net-savvy of her readers will be able to verify their authenticity. And as readers start adding to their collection of texts published in Stage 2 who have already saved the public key from Usenet, all they need do to validate authentic texts and invalidate fake ones is to check the signature.

Is she thinking along the right lines? Or is there a gaping hole in the idea which her opponent will be able to drive a tractor through?

Improve this question
$\endgroup$
1
  • $\begingroup$ Obligatory XKCD More substantively, if unidentifiable people are fighting on the Internet, I won't spend my time tracking down and checking signatures to see which unidentified person is or is not the same as which other unidentified person, I just ignore both or all of them. $\endgroup$
    – dave_thompson_085
    Dec 15, 2018 at 20:38

1 Answer 1

Reset to default
2
$\begingroup$

Yes, properly implemented including choice of keys and parameters, what's proposed makes Bob detectable when publishing texts under the pseudonymous identity used by Alice in stage A.

One detail is not made explicit: in step A2 the "signature made using her PGP private key" must be a (detached) signature of at least the text in A1. It is not useful to include in what's signed the PGP public key and fingerprint; but as long as it remains easy to verify the signature and extract the public key and fingerprint, such inclusion does not harm.

In stage B, Alice should I believe try to keep the same signing habits as in stage A, still including her PGP public key and fingerprint, and signing the same elements as she did in stage A. Things still work if the public key is removed (like due to limited publishing space), but including it eases the work of whoever actually try to sort out things, and makes it easier to detect forgeries when Bob chooses the first or second of these strategies:

  • not including a public key in his messages
  • including his public key in his messages
  • including Alice's public key in his messages

Per common practice, the date carried in Alice's signatures should be shortly before the date of the usenet posts or publication; anything else will raise suspicion.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Many thanks. But when you say things still work "if the signature is removed", is that a typo for "if the public key is removed"? Otherwise please can you explain the reason. $\endgroup$
    – Lunchy
    Dec 16, 2018 at 9:56
  • $\begingroup$ @Lunchy: When I said that, it was a plain mistake, fixed now. I meant public key. $\endgroup$
    – fgrieu ♦
    Dec 16, 2018 at 10:07
  • $\begingroup$ I was thinking about what you said about Stage B and how it would work to include the (40 hex digit) fingerprint without the public key, even if this could reduce convenience for a reader who wanted to verify. Am I right that in principle Alice could include the fingerprint without the key in the Usenet posts in Stage A too? (Although I realise a reader has to be able to get the public key from somewhere.) $\endgroup$
    – Lunchy
    Jan 2, 2019 at 16:25
  • $\begingroup$ @Lunchy: Yes, as long as the public key is somewhere to be found (like, in a keyserver), was generated by Alice, and the (40 hex digit) fingerprint remains second-preimage-resistant (which is believed to holds), Alice is OK with fingerprint rather than key in her messages. $\endgroup$
    – fgrieu ♦
    Jan 2, 2019 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.