Verify my Identity

Due to the rise in online impersonation accounts, I’ve been taking measures to help people verify my identify and check if an account you see online is actually from me. Below is my RSA Public Key. I use the associated private key to sign messages. You can use this key to check if an account or message is actually from me.

How? Each of my public accounts has an associated message, which I’ve signed. There should be an RSA signature on that account’s profile, or associated page. If you want to check that I’m actually the owner of that account, ask the account holder for the associated message. If you compare it with the signature, as outlined below, it should be verifiable that the I signed that message.

You can use this Python code to do this:

from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import hashes

# Load the public key
with open("public_key.pem", "rb") as public_key_file:
    public_key = serialization.load_pem_public_key(
        public_key_file.read()
    )

messages = [b"Message"]

# Verify each message
for index, message in enumerate(messages):
    # Read the signature from file
    with open(f"signature_{index}", "r") as signature_file:
        signature_hex = signature_file.read()
        signature = bytes.fromhex(signature_hex)
    

    public_key.verify(
         signature,
            message,
            padding.PSS(
                mgf=padding.MGF1(hashes.SHA256()),
                salt_length=padding.PSS.MAX_LENGTH
            ),
            hashes.SHA256()
    )
    print(f"Message {index} is verified.")

Put my public key in a file called “public_key.pem”, the message in the place that says “Message”, and the signature in a file called “signature_0”. It should verify! If it doesn’t you’ve got an imposter on your hands.

How does this verify my identity?

If you’re curious, this is one of the uses of RSA Encryption. RSA is a symmetric “public key” encryption algorithm: basically, there are two keys. One key (the private key) is kept secret. The other key (the public key) is published for everyone. The basic idea of the method is that:

If you encrypt a message using the public key, only the private key can decrypt it
If you encrypt a message using the private key, only the public key can decrypt it

This has many applications, but the basic idea is as follows:

I want to demonstrate to you that I own an account.
I take a message, which only I know, and take the hash of it.
I then encrypt the hash using my private key.
I post that encrypted hash on my account.

Later on, you come across the account and want to check it it’s me.

You go to my website (this one) and get my public key. You know this is my key, since you trust this website.
You use the key to decrypt the hashed message. You now have a hashed message.
You ask the account holder what the message was. They respond.
If the hashed message matches the hash of their response, it must be me. Otherwise, they’re a phony.

This works because (1) only the holder of the original private key (me) could have encrypted the hashed message that you decrypted, and (2) even if you knew the hashed message, you couldn’t know what the message was from the hash. Thus, only someone who both (1) knew the original message, and (2) could encrypt it with my private key could respond correctly. That must be me!

If I skipped the hashing step, anyone could copy the encrypted message and put it on their page, and pretend they were me. Using this method, they must also know the know the message to verify their identify. This is functionally impossible, as long as I’m careful to rotate messages frequently and don’t share them with others.

How does this verify my identity?

Menu