# Encryption - How to claim authorship anonymously?

In my writing, a guy wrote a politically acrimonious pamphlet (basically the summary of the communist manifesto) and disseminated its copies secretly.

The guy just so happen to be a very vain person and so, even though he knows that if the authority ever finds out that he had written the things, he would be punished, he still wants to somehow make it possible to prove to the public that he had written the pamphlet if he wanted to.

My idea right now is to include a block of text at the end of the pamphlet like this:

111001111011100000
100101001010010000
111001001011100000
100101001010010000
111101111011110000

Where if you use ctrl+f and search for "1", you will see the above spelling out "BOB". However, not only is this not very space-efficient, it is also not very secretive. I want to make it so that only Bob the author can come forth and say "If you look for the letters in 'abduction', and draw lines connecting them in the reverse order, you will see it spelling out my initials and birthday."

Any bright ideas?

• Sure, but what's his name? Some bright ideas might not work for all names. – AngelPray Jan 7 '17 at 18:11
• @WillowRex Can you explain how a pen name that is impossible to track to a real person can be later proven as belonging to somebody? – Luna Jan 7 '17 at 18:15
• How about you add the name Bob as your pen name? In the meantime, no one is admitting to be Bob because they'll be arrested or ostracised, right? So in something like a safety deposit box, before you publish, you put something dated like an time stamped image of the pamphlet and you - the real Bob. The bank records you made the deposit on that date and have not returned to the safety deposit box. So now, when you want to admit to being Bob, you have proof. – WRX Jan 7 '17 at 18:20
• I find it amusing how many posts here are violating Security Rule #1: Never try to create your own encryption algorithms (always use a known library). ;-) It's rule #1 because even experts almost always get it wrong without LOTS of peer review. – SRM Jan 8 '17 at 1:26
• Reality has caught up with you... academia.stackexchange.com/questions/56941/… – Celebrian Jan 8 '17 at 16:35

## Use a one-way function

This is a type of mathematical function which is relatively straightforward and easy to calculate. But if you're given only the result, it's almost impossible to figure out what input led to it. Also known as a "trapdoor", since going through it one way is easy and the other way is difficult.

One example is multiplying primes. Multiplying two large prime numbers is straightforward, and a computer can do it in an instant. But figuring out which primes were multiplied to make a certain result is almost impossible; the best known methods boil down to "try a lot of primes until you find the right ones".

A certain type of one-way function is a "cryptographic hash". This reduces an arbitrary amount of text to a very large number, such that any change to the text changes the number. For good hashes, such as SHA, finding a text which produces a given hash takes an infeasibly large amount of time.

So he could pick a strong hashing algorithm, one unlikely to be broken in the next few years, and calculate the hashes of "BOB WROTE THIS", "bob wrote this", and "Bob Wrote This ABCDE". Then include those very large numbers at the end of his manifesto. (He doesn't need to mention that they're hashes, or what algorithm was used, or anything about it, just include them.)

If he later wants to claim authorship, he can point out that hashing "BOB WROTE THIS", "bob wrote this", and "Bob Wrote This ABCDE" produces the numbers in his manifesto. The odds of this being a coincidence are astronomically low.

If the NSA wanted to break the hashes, brute force would most likely find them only a random string of letters which hashed to the same result.

And if someone else wanted to claim credit, even if they managed to come up with some text like "PhIL wAS_HERE KUGDSJHGF" which happened to match Bob's first hash, Bob's evidence (matching all three) would be far more convincing.

This is actually implemented on Wikipedia accounts and they have a whole page on how to do it right.

The tech you're looking for is Digital Signing. You use public/private key encryption. With this kind of encryption, anything encrypted with the public key can only be decrypted with the private key. You can only decrypt with one and encrypt with the other.

You take the document and encrypt it with your private key. Then you attach the encrypted version to the end of the document. Both are disseminated together. The earliest copies anyone can find online all have the same signature. You also attach the public key.

Anyone can prove that the signature is valid because they can use the public key to decrypt the block of text and prove that it really is the rest of the document. But no one else can create that signature.

Later, when you want to prove you are the author, you disclose that you and you alone have the private key that is capable of creating the signature. TADA! They know you wrote the document.

There are other schemes, with various levels of ease of implementation and security. I present this one here just as the easiest to understand as a starting point.

• Note that this approach also allows Bob to write several pamphlets and prove that they have all been written by the same author. (Well, that they've all been "typed up" by the same typist/encryptor, anyway.) His readers will say, "I don't know the source of these pamphlets, but I know that they all came from the same source." Bob still gets to choose whether to reveal himself as that source, at a time of his own choosing. – Quuxplusone Jan 7 '17 at 21:45
• We normally don't call a digital signature encryption. – CodesInChaos Jan 7 '17 at 23:24
• To prove that you have the private key capable of creating the signature: simply allow any observer who is skeptical to send you a message of their choosing; then sign it with your private key. They can still use the public key they already have to check that the signature is valid. – Daniel Wagner Jan 7 '17 at 23:54
• @CodesInChaos True, but I figured the detail of creating a hash of the document, then encrypting that, was a bit much to get into here... I provided the link and said there were other implementations. – SRM Jan 8 '17 at 1:18
• Beware, though, that you don't use the same key pair for anything else, or people might realize in the most inopportune moment that they had already seen that key somewhere... Oh, yeah, they used it when talking to Bob. – John Dvorak Jan 8 '17 at 2:27

Introducing deliberate and intentional spelling errors to the text

This is a practice I have learned from my business & economics professor. The practice is related to business proposals that are sent to potential funders for an idea/business/project.

In order to prove that someone else released and unauthorized copy of your work, you can introduce deliberate errors to spelling and grammar. When stumbling upon a copy of your work or some work that uses your ideas and work it is easy to find out who leaked the information and get back to them.

How can we use this?:

1. Using this technique your author could introduce a set of errors, typos, etc. to the version of their work they plan to publish.
2. Before publishing the critical manifesto they can place another document in the public domain, authored in their real name, which in turn could contain material totally unrelated to the manifesto, but with the same written errors & mistakes.
3. Whenever they want to claim authorship they can point to this correlation which is quite unlikely to be a mere coincidence.

This technique would allow to claim ownership without previously pointing to attempts to do so.

• This is called a "canary trap" in espionage fiction. See also a similar practice for dictionaries and encyclopedias. – AlexP Jan 7 '17 at 19:04
• @AlexP nice find, thanks for the link :D – dot_Sp0T Jan 7 '17 at 19:05
• I suppose this provides some evidence to substantiate the claim, but it's not a "proof" in the way a digital signature is. It's also not hard to imagine that a sharp-eyed reader would notice the errors, and perhaps even notice the pattern. I always thought this sort of thing was most useful when there are multiple copies or versions of the document in circulation (put different errors in each copy to track them) and you don't expect a lot of people to be checking them carefully. – David Z Jan 8 '17 at 3:58
• I don’t think that finding the source of a leak is anything like what was being asked. – JDługosz Jan 8 '17 at 8:28
• @DavidZ the practice stems from that, yes. I've let it inspire me and then show in the second part of the answer how to adapt it to get a desired result. I also did not say this is better or anything than a digital signature. It is merely another way of doing something to achieve similar results. It also does mot require any advanced technology besides simple writing utensils and some third party that tracks publications (e.g. A newspaper or a library) – dot_Sp0T Jan 8 '17 at 8:43

SRM's answer is correct: digital signing is what you're looking for. It's single goal is to do exactly what you are asking for.

However, traditional signing only goes so far. It only proves that you chose to sign a document, it doesn't stop others from signing it too. Its entirely possible to take a signed document, strip the signature, and apply your own signature.

In most cases, this is unimportant, because the purpose of the signature is to hold the signatory to something. However, this is a bit different. The author wants to be able to prove not only that he signed it, but that he originated it. Consider the case of a malicious government that wants to erase Bob's name. Rather than trying to unsign Bob's signature from the document, they generate dozens of fake signatures. They spread documents that suggest Alice signed the document, or Carol signed the document, or Dave, or Eve. All of them with forged timestamps to confuse the question of who released the document first. Bob's name could get lost on the mud, squelching his message in a pile of fake owners of the document.

There's two ways to control information. One is to prevent information from getting out. The other is to drown the information in a sufficient volume of fake information as to hide it from anyone who is looking.

There is a recognized approach to solve this, which involves a "trusted third party." The traditional third party is a newspaper, but any widely disseminated source of information will do.

First Bob writes his paper. He then calculates a cryptographic hash of the paper. This is a "mostly unique" fingerprint for his document. It is astronomically unlikely that two documents will "collide" and have the same fingerprint, and the algorithms are designed to also make it hard to maliciously make two documents collide. We have many in use today, SHA-3 being the most recent major algorithm.

Bob then writes up a claim. He writes I am the originator of the manifesto whose SHA-3 hash is f4202e3c5852f9182a0430fd8144f0a74b95e7417ecae17db0f8cfeed0e3e66e. He then digitally signs this claim using the digital signature approaches SRM talked about.

Now for the nifty part. Bob then takes out a classified ad in a few major newspapers. Such an ad is cheap and easy. The add contains nothing but his claim I am the originator... and the digital signature for that claim. After submitting these, Bob waits. Usually one day is enough. All that matters is that the message is properly disseminated into print. After this, Bob can send out his manifesto. The manifesto itself can be signed or unsigned, it doesn't really matter. Just the message put in the classifieds actually needs to be signed.

Once the government sees this message, they want to squelch his name, so they want to re-sign this paper with as many people's names as possible. However, Bob can now point to the classified and say "this is the oldest record of anyone claiming to be an originator of this document, and I hold the private key it was signed with." His claim is now special because anyone can go find a copy of the paper on the date Bob says to look in, find the classified ad, compute the SHA-3 hash of the document, make sure it matches the claim in the ad, and then check his signature. The government can release any number of similar classifieds, but all of them will be dated after Bob's claim. To date it before Bob's claim would require the government to go find every single copy of the newspaper and replace it with their own (very 1984esque).

The key to this approach is that the signed affadavit in the classified comes out before the document is released. Thus, there's no opportunity for the government to create their own fake claims. The best non-1984 solution would be for them to intercept the request for a classified ad, and quickly replace it with their own ad. However, if they do this, Bob reads the paper when it comes out the next day, finds out that his ad has been replaced and doesn't release his manifesto. Instead, he simply changes something minor in the manifesto, re-hashes it, and tries again. Eventually the government will fail to intercept his work, and then he can safely release the document.

Write manifesto in specific way

Problem with this society is that young do not listen.

Later the young will get to the power

Easy solution is none.

Although, I can offer one.

Solution? Dare I say?

Enormous effort was put to this manifesto.

Having plan to change this society, I am writing these lines.

Economy is struggling and we need to do something.

Love is waining and marriage is crumbling.

People need a change

Now read first letter of each sentence. This method is called steganography and only Bob can show that there is other message hidden in the manifesto.

Well, obviously, the manifesto must be written in certain way and also the message cannot be easy to find (like mine)

• This can also be combined with hash verification. For example, the hash(es) of the unknown string can be encoded steganographically, making it harder for an adversary to simply strip the hash from the text. – March Ho Jan 8 '17 at 16:24
• This and dot_Sp0T's answers the only methods for OP's situation. 7answers and only 2 more or less correct, woow. – MolbOrg Jan 8 '17 at 16:34

Certainly the easiest way this could be achieved, and be authenticated with confidence is printing the hash of a password selected by your author inside the text somewhere. For example, if your guy chose the phrase "itwasreallyme", and hashed it using the SHA-265 algorithm, he would print

c82d72f2befe046245287e2a9f797e31706a518a65eaf27b7e86759079ff07d3

somewhere in the book. When he wished to authenticate that he was indeed the author, he simply regenerates the hash from his password, which matches the one in the text. Of course, this relies on him keeping his phrase secret!

• The downside of this is that it doesn't allow readers of the document to verify that the signature is a valid signature until the day you produce the password. With public/private encryption keys, readers of the doc can use the available decryption key and prove that the attached signature really does relate to the given document, instead of being a random string that claims to be a signature. Public/private also lets users prove (as @Quuxplusone noted below) that multiple documents come from the same source. There are other weaknesses with this simple password version. – SRM Jan 8 '17 at 1:22
• It's worth noting that this approach of publishing a scrambled message and then later revealing the meaning dates back to Galileo at least - though this was so he could prove prior discovery mathpages.com/home/kmath151/kmath151.htm – John Carter Jan 8 '17 at 10:13

Does Bitcoin (or equivalent) exist in your world? If so:

(2) Mask it (append a random string), sign it (digitally), and hash the result.

(3) Embed the hash into the blockchain.

(4) Wait several hours until it is confirmed deeply enough.

(5) Publish the manifesto, the masking string, and the signature, include a link to the transaction with the hash.

(6) Keep the private key, if you need to publish anything (or state your opinion on an issue) in the future, sign it with the same key and do the same blockchain trick again.

It would cost a small amount of Bitcoin each time.

Encrypt a message about who wrote it in a substitution cypher. Each letter gets replaced by a different one as a random shuffle. You can then reveal the key to prove authorship. If the message is too short <10 letters, then someone could find another key that decrypted the message to a different piece of meaningful text. If it was too long, 100's of letters, then people could crack it. A shuffling of 26 letters has as much randomness as 18.8 random letters because you have fewer options left that haven't been used yet in the shuffle.

eg

VUHTVQPZMKHTXMDKOZKHTHMWDPZPZTWQZWVQZZTRQ


Key

abcdefghijklmnopqrstuvwxyz
TOIMQNRDPJAXVHKBLSZWGFEYUC


So with the key message

mynameisdonaldhobsonandthisisatestmessage


is easily deduced. But only with the key. Keep the key secrete and his identity remains hidden.

• Even before computers, substitution cyphers were trivially crackable. Also, has all the same weaknesses as the SHA-256 answer provided by @user2662468. – SRM Jan 8 '17 at 1:25