Authenticating Charles Hoskinson

Opens February 19th 2024 to make a shareable reference video on authentication, since people keep emailing to ask whether a LinkedIn, Facebook, or Twitter contact is the real Charles.

Gives the rule of thumb that unless he has a specific reason to reach out, anyone cold-calling while claiming to be him is almost certainly a scam, but public-key cryptography lets him actually prove it is him.

Public-key cryptography: a public and private key linked by a one-way hard math problem, easy to go from private to public but infeasible to reverse, taking all the time in the universe.

RSA is the granddaddy and the basis of PGP, Pretty Good Privacy, created by Phil Zimmerman in 1991 and maintained by early Bitcoin pioneer Hal Finney.

A two-way challenge protocol where Alice encrypts a message with Bob's public key and only Bob, holding the private key, can decrypt it and return the original.

Shows Cleopatra managing his personal email key from 2013 and work key from 2016, both RSA 4K, whose fingerprints match the one he displays in his content.

Demonstrates the one-way proof by signing a Hello World message so that anyone holding his public key can verify it came from him.

The signed message hashes the text and signs the hash, which is transmitted to Alice, who verifies it against a trusted copy of his public key.

Shows how to verify Satoshi Nakamoto's real PGP key, published by the Satoshi Nakamoto Institute, by importing it into Cleopatra.

Satoshi's public key was created October 30th 2008, the day before Halloween, tied to an anonymous GMX email, and is not a particularly strong key.

Anyone truly Satoshi could sign an I-am-Satoshi message with the private key, verifiable by everyone, and the scheme stays secure even against AGI or a quantum computer.

A quantum threat can be countered with lattice-based cryptography that still produces verifiable signatures, and that he authenticates by signing an email with his Gmail key.

You can find his fingerprint on his Twitter and download his public key from keys.openpgp.org, recommending the free Mailvelope browser extension to verify signed messages.

Merely asking a scammer to sign a PGP message usually dissuades them, which is the whole Craig Wright issue, since the real Satoshi would simply sign with the original key.

Lace will integrate an identity center using the Prism framework, now on Hyperledger, built around the DID standard of an identifier plus a JSON document holding public keys.

The first use case is a paper wallet generator, since a wallet backup is the 24 BIP39 keywords people are told to write on paper and store in a safe.

Proposes generating a PDF with a public QR code and a private QR code encrypted with your PGP key, managed via a DID credential and hardware like a YubiKey.

You could even generate an encrypted wallet for someone else that only their private key can decrypt, restoring it by scanning the private QR to a webcam and authenticating with PGP.

With a DID and associated key you back up by password or public-key encryption, and that it is so secure he will publish a paper wallet holding a million dollars of ADA and let anyone try to crack it.

Extends the identity center to authenticated channels against deepfakes: a video caller claiming to be Charles stays red until they pass a challenge-response with the DID private key, turning green with one click.

The same works for any file, since any file can be hashed and signed, making authenticated pairings a killer feature in the age of generative AI, built on 1991 public-key cryptography.

Cryptography provides authentication, non-repudiation, and message integrity, and that a paper wallet generator is overdue since printing exposes a replay attack through the printer buffer.

Reaffirms he will never contact you for ADA or announce a giveaway, and that blockchains are perfect key servers, as the early Bitcoin project Namecoin showed.