29

A few years ago there was this hacker (don't remember who he was) that full disclosed a vulnerability in a given system, but to make sure nobody took credit for that, he created some kind of PGP key.

What I understood at the time is that he created a key to ensure he was the one who discovered it, but didn't disclosed who he was actually, just created some mechanism to be able to prove that he was the one who created the disclosure.

Ok. I get how algorithms and cryptography works. But I still don't understand how you can create a key to protect a given content disclosed in the web to prove you are the one who created it first! It is just words!

Is it really possible? What should be the process to ensure you can empirically prove it? Did I understood it correctly or I probably missed something regarding this case?

I hope this question is specific enough, basically it is just how to protect a content that you created in the web (a paragraph, a code, a word, etc.) and make sure you are the one who created it first, inside a given context.

With my knowledge I don't see how that is possible, but I am intrigued if there is a practical way to do it. Is there?

  • 9
    Maybe asking at crypto.stackexchange.com would be better idea? – Euphoric Dec 15 '14 at 13:08
  • 5
    @FagnerBrack - Don't copy/paste. Just flag the question for migration to crypto SE. – mouviciel Dec 15 '14 at 13:12
  • 10
    But I still don't understand how you can create a key to protect a given content disclosed in the web to prove you are the one who created it first! It is just words! There's a difference between proving you created something and proving you were the first to create something. The PGP key can prove the hacker submitted the vulnerability report. There's no guarantee the vulnerability wasn't discovered or reported before him, but he can at least show that he had reported it on a certain date. – Doval Dec 15 '14 at 13:16
  • 2
    There was a story about a mathematician that discovered a proof and didn't want to publish it yet but also didn't want someone else to get credit. So instead he published the letters of sentence of the proof sorted alphabetically. I forgot what his name was. – Paul Dec 15 '14 at 20:25
  • 3
    @Paul - that would be Robert Hooke, Hooke's Law en.wikipedia.org/wiki/Hooke's_law – James McLeod Dec 15 '14 at 20:45
1

I probably missed something regarding this case?

I think the bit you are missing is a trusted entity.

When you hash the file with the content you want to certify, you can show to the world that you are the owner of this document, without disclosing this document. This is all very well, but how can you prove you had this document at some specific time in the past ?

This is what Trusted Timestamping is about. Here is an extract from wikipedia:

The technique is based on digital signatures and hash functions. First a hash is calculated from the data. A hash is a sort of digital fingerprint of the original data: a string of bits that is different for each set of data. If the original data is changed then this will result in a completely different hash. This hash is sent to the TSA*. The TSA concatenates a timestamp to the hash and calculates the hash of this concatenation. This hash is in turn digitally signed with the private key of the TSA. This signed hash + the timestamp is sent back to the requester of the timestamp who stores these with the original data (see diagram).

(*) Time Stamping Authority

I have been using Universign's Timestamping Service, which has a nice set of tools to make the whole operation easy to perform. There are plenty of companies offering similar services.

It is interesting to note that, as @JoelFan mentioned, that bitcoin provides a way to get a trusted entity that is not centralized (why should I trust anyone ?). The bitcoin chain provides a timeline (you can prove one document incrusted in the bitcoin chain was created before another further down in the chain). To my understanding, however, you would still miss the effective date and time of the event.

Also, Trusted Timestamping is a valid reference in litigation.

|improve this answer|||||
  • 2
    There are date-times embedded in the block headers in bitcoin... although they are not enforced by the protocol, they are generally trusted to be at least "ballpark" accurate (i.e. well within 1 day accuracy)... it's also possible to inspect the entire blockchain from the block in question until today to make sure the date-times are monotonically increasing – JoelFan Dec 17 '14 at 15:12
  • Sorry to take too long to accept an answer. The hacker probably used a trusted entity, I couldn't find a reasonable way to protect the content authorship without a trusted entity. – Fagner Brack Mar 12 '15 at 8:53
39

In days of old, scientists would publish anagrams of their work to be able to say "I thought of this idea." (look at the 'history' and 'establishment of priority' sections) The thing is, they wanted to be able to take credit for it, but also give other scientists to publish their results if they had other ideas without building on the original idea.

For example Gallileo published SMAISMRMILMEPOETALEVMIBVNENVGTTAVIRAS which was an anagram of altissimvm planetam tergeminvm obseravi which translated from Latin reads "I observed the highest planet in threefold shape". He got it wrong - Saturn (the 'highest' planet known at the time) isn't built of three parts. Fifty years later, Christiaan Huygens published AAAAAAA CCCCC D EEEEE H IIIIIII LLLL MM NNNNNNNNN OOOO PP Q RR S TTTTT UUUUU which in Latin is Annulo cingitur, tenui, plano, nusquam cohaerente, ad eclipticam inclinato which translates to "It is surrounded by a thin flat ring that does not touch it and is inclined against the ecliptic."

While those are historical bits now of interest, they show an important concept back then - providing a 'hash' that is easy to say "this hash encodes this text." It is easy to go from the known text to the anagram or the hash, but hard to figure out what it is if you don't know what it is in the first place.

With the modern mechanisims, we have other ways of doing hashes. Many of them are very closely related to cryptography. There is the cryptographic hash function. The idea being, still, it is easy to go from the text you know to the hash, but hard to go from the hash to the text you don't know.

And so, if you have a program you could publish a hash of the program that does something and then when you are ready to disclose it (possibly after the company fixes it or a period of time later), you can publish the actual code and everyone can see that, yes, this code matches that hash.

|improve this answer|||||
  • 1
    Very nice bit of history about the use of hash before the digital age :) – mika Dec 17 '14 at 12:48
30

You can do that quite easy. If you have a plaintext text, secret key S and public key P you do S(text) and get the cipher.

Now you can publish cipher and P but not S. Therefore, everyone can decrypt the cipher with P by doing P(cipher). If you now want to prove, that you are the one who created the cipher (and therefore the original text), you can either publish S, or - if you don't want anyone to know S - you can create another S("I was really the one who found the text first") and publish it. Because there is no way to create a cipher that is decrypted with P(cipher) that results in some meaningful text.

That is how you can prove it.

|improve this answer|||||
  • 13
    How does this help? Anyone who can decrypt cipher can just republish the same way with their own secret key and you have no way of proving which party published first and which copied from the other without trusting some third-party record of publication time. – R.. GitHub STOP HELPING ICE Dec 15 '14 at 18:04
  • 2
    @R.. Content on the internet usually has a date associated with it (e.g.: forum posts). If there are multiple people claiming to be the original inventors/ discoverers, then you just check the dates. – Paul Dec 15 '14 at 18:26
  • 2
    You can also include some content in the plaintext that is encrypted via P(content). The true owner of S will be able to decrypt that additional information, whereas a reposter will not be able to do that. – Dancrumb Dec 15 '14 at 19:30
  • 10
    @Paul: But then the encryption is irrelevant. It's equivalent to just posting your plaintext content and relying on the date. – R.. GitHub STOP HELPING ICE Dec 15 '14 at 20:16
  • 2
    @R.. the idea is that, without knowing S, it is very hard to come up with a piece of text cipher2 such that P(cipher2) isn't gibberish. With S it is trivial, as S("the text you want") = cipher2. Doing the reverse amounts to defeating the crypto method. – congusbongus Dec 16 '14 at 2:07
21

It's possible to hash the data you wish to timestamp and turn it into a Bitcoin address. This is known as trusted timestamping. By making a small payment (a satoshi, or 0.00000001 BTC) to it, the payment is stored on the blockchain along with the address you paid to.

Since only the hash is stored on the Bitcoin blockchain, no one can tell what data you stored, but given the pre-hashed data you can prove the data was created prior to the block that contains the payment made to that address.

|improve this answer|||||
1

A very simple way to establish that you are the first one to publish something, without revealing who you are immediately but having the option to do this later:

  1. Publish it on a well known public source (there everyone can see that you published it)
  2. In this publication, add a line: Originally published on dd/mm/yyyy by the owner of xxx@gmail.com

No need to encrypt anything.

Of course there is the chance that you don't want to publish your results yet. In that case you need to encrypt everything except the line with the email address. However, now it may be harder to get this published on a renowned site.

|improve this answer|||||
  • 4
    What if the "renowed site" changes the date or the publication e-mail? It can happen due to bad intentions of even if the site is hacked. (Ok I am being quite paranoid here, but that's the point. If there is a way someone else besides the original author changes the proof, then your solution is not really deterministic). The point here is not to rely only in human witnesses, but in a way that anyone can confirm authorship in a certain way without your content having to be "published" or "patented" by a trusted entity. – Fagner Brack Dec 15 '14 at 16:08
  • @FagnerBrack, arxiv.org has proven sufficient for nearly 1M research papers. – Brian S Dec 15 '14 at 22:45
  • 1
    Can I put just anything there or it should pass through some peer review and will only be authorized under specific constraints? This question is not aimed directly to research papers, it is about the possibility to achieve the same result (or equivalent) in a programatic way. – Fagner Brack Dec 15 '14 at 22:52
  • 2
    Use archive.org to publish - like arXiv, it's a very long lasting and trusted repository, but unlike arXiv it's free to upload content there. The timestamp on anything you publish there would be considered very reliable. – Steve Midgley Dec 16 '14 at 5:28
  • 1
    I agree, fame is the only way to spread knowledge fast and reliably. – bigstones Dec 16 '14 at 6:35
0

This is a different take on valenterry's answer.

Here's how you would do it using PGP:

Generate a public/private key pair.

  1. You keep the private key and you make sure it stays secret.
  2. You encrypt your idea with your public key: P(idea)
  3. You put P(idea) somewhere that is trusted(not by you, but in general) and will log the time.
  4. When you need to prove you made the idea first, you get the timestamp from when you stored the data, and you decrypt your data with your secret key. S(P(idea)) => idea

This method doesn't require releasing your secret key, which in general is a bad idea. Granted, you can always make a new PGP key pair - it doesn't cost anything, but you shouldn't be recklessly handing out secret keys if you want to be credible.

The hardest part is proving the time, but in terms of documenting a vulnerability, we don't need a 100% bullet-proof-and-verifiable-in-court solution, we just need something that's 'good enough'. The logs of a cloud storage provider(dropbox, rackspace, google, etc) is probably good enough, assuming they implement a secure service.

It's also worth noting that being the first one with an idea and timestamping it has never meant that you were the first person to think of the idea. If someone thought of it before you but never registered the idea with a timestamping mechanism, then they can't prove they made it before you. So, if we're trying to figure out who made it first, and all we know is the time you came up with it, then we have to assume you came up with it first(the other person could be spewing lies).

|improve this answer|||||
-1

Ugh, so many of these answers are missing the point.

1) What the hacker did had nothing to do with encryption.

2) What the hacker did had nothing to do with time (the time stamp, etc).

What the hacker did was Publicly Sign the release document. When you PGP sign something (an e-mail, a word document, etc), you create a hash which is the sum of the hash of the document being signed, and your own private key. Now, to prove that you are the creator of the document, you just need to "show" the private key, as presumably only the author knows it. Cryptographically speaking, you can "show" that you are in possession of the private key without actually showing the key itself.

So, in effect, he digitally signed the document. The only person who can copy that signature, is someone with his private key. There is nothing to say that the document was made today, or yesterday, or was the first instance of it to exist ever. No amount of hashing timestamps or whatever will change that.

The only way to digitally sign something IN TIME, is to use the blockchain a la bitcoin. There could be no digital currency without time verification - the fact that person A sent money to person B is irrelevant unless we know when. You cannot go into a shop with a piece of paper and say "my mum sent me $100 once. I would like to buy some bread", because a receipt of a transaction doesn't mean the money still belongs to you. You might have given it to someone else in the interim. The blockchain solves this issue by getting a large number of people (bitcoin miners) to all agree on the fact that the transaction happened at a certain time (and then by recording that time in the blockchain forever).

|improve this answer|||||
  • 2
    this doesn't seem to offer anything substantial over points made and explained in prior 6 answers (in particular, a lot was written about trusted timestamping, and bitcoin approach was presented already) – gnat Dec 17 '14 at 21:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.