18

Just like how a user can prove they are the owner of a Bitcoin public key by signing a message, how can a Monero user prove they are the owner of a Monero public key?

21

Best is to sign a message consisting of your address, with your address. The sign and verify commands have been merged just yesterday: https://github.com/monero-project/bitmonero/pull/818

First, make a file with the data you want. It just happens that, when creating a wallet, your address is saved in WALLETNAME.address.txt.

Then, sign: sign WALLETNAME.address.txt

Then send the signature output by that command to the other party, who can now verify: verify WALLETNAME.address.txt 4xxxxxx SigV1xxxxxx

  • If you just sign your address, how does that prove that you own it? How would the person know that you didn't get that message from the actual owner. Wouldn't it be better to sign some random message the questioner provides, or sign a message connecting it to your identity (like "This address is controlled by user36303 on monero.stackexchange.com" or "This address is controlled by John Doe")? – PyRulez Sep 6 '16 at 23:14
  • This method can sign an arbitrary byte string. – user36303 Sep 7 '16 at 8:37
  • Can you say more about what you mean by this? To followup PyRulez comment, what is to stop me from taking any address (the XMR dev donation address, for example), placing it inside a txt file, and signing it with a gpg key? – user4 Oct 8 '16 at 18:57
  • Nothing. You're free to do this of course. You can sign anything with a GPG key, or with a Monero key (or with a scout's honor speech). – user36303 Oct 8 '16 at 20:06
  • @user4 If you want to prove that you hold the private key to the XMR dev donation address, you sign a message with the private key to the XMR dev donation address. And as PyRulez points out, the message ought to be some random text supplied by the person who's asking for proof, in case you're an imposter who's recycling some one else's already-signed message. – TEV Jan 6 at 0:42

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.