Post
Topic
Board Bitcoin Discussion
Merits 1 from 1 user
Re: Why is Satoshi Nakamoto's PGP Key not currently on bitcoin.org ?
by
Carlton Banks
on 27/10/2020, 14:52:46 UTC
⭐ Merited by BitcoinFX (1)
Why didn't satoshi signed with a bitcoin address to prove his identity?

I don't think there was a standard way to do that in 2011/12 (after which Satoshi stopped posting/emailing totally)


Do you think that it would be possible that in the future bitcoin address may replace PGP keys?

I am more comfortable in proving my identity using a bitcoin signed message than a PGP key. I use bitcoin addresses a lot but I barely used a PGP key. As you said it is safer, isn't it a good substitute?

There's nothing wrong with doing it, but you need another way to prove that you own the Bitcoin key. If your email or forum account (or social media) got hacked into, anyone can then write a message/post saying:

"Hi bitmover here, I changed my key for signing messages to 3et7849bfjff9ss0awn4n3m2aswlsonqw"

....then they could change the password to the account too, and your 'bitmover' id would be stolen. PGP is designed to avoid that (but it's still possible to trick people using that kind of social engineering attack with PGP, better awareness of good practices with crypto keys/certificates is the answer)


An interesting read ...

New PGP key: RSA/RSA or DSA/Elgamal?
- https://security.stackexchange.com/questions/72581/new-pgp-key-rsa-rsa-or-dsa-elgamal

you're slightly proving my point here... PGP keys should have an expiry dates, or at least the subkeys (of a master key) should. That's why people are asking questions like that on stackexchange.com, and Satoshi eventually almost certainly understood this too. You'd be quite unwise to trust Satoshi's PGP key  from 2008 alone when it's concerning such a significant person.

BTW, the most secure PGP keys use the Ed25519 curve, you need to enable some kind of expert option to use them though (I think it's literally gpg --expert --full-generate-key). Ed25519 keys were not added to GnuPG until 2014 or so, long after Satoshi disappeared.