Originally spun out of this discussion we need a more robust means of externally verifying ownership of a certificate.
Problem Statement
How do you verify ownership of a certificate? Once we have strong ownership as a core feature of our cert-wallet app, you can prove to yourself that you own a certificate, but how do you prove it to a 3rd party? As an open-source app, the code on a phone can be modified to avoid this check, so just having something that looks like cert-wallet and says it’s owned by the recipient isn’t sufficient.
Proposed Solution
I’d like to use the public/private key nature of the bitcoin address embedded in the certificate to issue a cryptographic challenge that only the owned Recipient could answer correctly. For purposes of this discussion, the Recipient is the person the certificate was actually issued to, the Challenger is the person trying to verify this ownership claim, and an Attacker is someone trying to falsely claim the Recipient’s certificate as their own.
I see two approaches, and I’m not sure which is more secure, more standard, or just better practice:
Approach A
- Recipient sends Challenger a certificate.
- Challenger generates a secret string as the challenge text.
- Challenger encrypts that challenge text with the public bitcoin address embedded in the certificate. Challenger passes that encrypted text to the Recipient, along with identifying information about which certificate Challenger has generated the challenge text for.
- Recipient looks up the private key associated with that public bitcoin address & uses it to decrypt the challenge text.
- Recipient sends the Challenger the unencrypted challenge text – if it matches the original challenge text then ownership is confirmed.
Approach B
- Recipient sends Challenger a certificate.
- Challenger generates a secret string as the challenge text.
- Challenger sends the unencrypted challenge text to the Recipient, along with identifying information about which certificate Challenger would like proof of ownership for.
- Recipient looks up the private key associated with that certificate & uses it to encrypt the challenge text. Recipient passes this encrypted challenge text back to the Challenger.
- Challenger attempts to decrypt this response from the Recipient with the public bitcoin address embedded in the certificate. If it decrypts to the original challenge text, then ownership is confirmed.
In both cases, an Attacker would fail to validate ownership because they wouldn’t know what private key was associated with that bitcoin address. They would be unable to complete this signing challenge.
This also has the advantage on working on completely untrusted Blockcert wallet code. Since the Recipient does not generate the challenge text, it doesn’t have the means to beat this cryptographic challenge.
Migration Approach
This feature is purely additive and will have no impact on the current feature set.
Open Questions/Feedback
Which approach?
As I write this, I have a preference for Approach A. In this case, the Recipient never knows the challenge text. If an attacker were able to brute force enough private keys quick enough in Approach B, it could figure out what encrypted payload to deliver so the Challenger would falsely conclude that the Attacker owned it. Not so in Approach A.
What’s good challenge text?
Should it be entered by a user? Should it be a random series of characters? Is there a minimum length or randomness required? Are there any cryptographic holes if an easily guessable challenge text is used?
How are challenges transferred between Recipient and Challenger?
Do we send these payloads as attachments in emails? As universal deep links? Local peer-to-peer communication over bluetooth? QR code scanning? All of the above?
Does a Challenger use the cert-wallet app, or something different?
This use case my be specific enough to merit its own app, although a lot of the models will be shared with cert-wallet. While most institutions (universities, companies, government organizations) will want proof of ownership for another’s certificates, that’s not really common among individual Recipients. I imagine if you’re challenging Recipients on ownership, it’s something you’ll be doing substantially more often than you’d receive a certificate.