Use Bitcoin for signing and trust chain

[kubicek]

We can use bitcoin keys for signing messages https://doc.satoshilabs.com/trezor-user/messages.html#signing-messages

We can also use bitcoin transactions to build trusted chain for master keys/department keys. Like colored coins just with grant/revoke flag in OP_RETURN.

I hope we can completely live without PGP, can't we?

[burningtree]

It sound interesting, but:

1. signing with Bitcoin address is too experimental, there are no solid specifications or tools.
2. PGP is not ideal, but it's like second factor in this case. If bitcoin collapse, we can not do nothing.

What do you see as a major drawback of PGP/GPG?

Anyway, write trust chain to blockchain sure we can do well, even if we have independent keys.
https://keybase.io/docs/server_security/merkle_root_in_bitcoin_blockchain

[kubicek]

1. There are no experiments required, just a normal private/public key operations. There are many tools which support signmessage and verifymessage. Normal bitcoin clients supports it and you can find many specialized libraries in different languages. For example https://github.com/michaelgpearce/bitcoin-cigs But maybe you mean something like infrastructure tools, for example for email signing, PDF signing etc. Right?
2. In case of bitcoin collapse (like if there will be no more miners), you loose only the ability to grant/revoke rights published this way. But I thing it means something like "If Internet collapses", it will never happen, it is decentralized.

[burningtree]

Experimental = inconsistent specifications, no security audited (!) - can you direct me to some specification paper?
I mean all sort of PROVEN tools. Do you really think that libraries with 6k total downloads, 1 contributor and zero activity are bullet-proof? no tools for storing, exchange, trust-control, encryption, subkeys... (functions integrated in bitcoin clients are irrelevant)
Collapse can be also an exponential increase of Bitcoin market value (fee).
I do not see any added value, if its only asymmetric cryptography that uses bitcoin access / address as keys (in short). The only possible advantage is ensuring integrity of keys, but this we do well with PGP keys (by writing metadata to blockchain).

I repeat the question, why do you think that PGP is so bad? What are the advantages of your solution?
I understand that bitcoin is trendy.. if this system will have a better foundation, then we can use it. But not now.

[lunokhod]

I don't see a problem with having both a PGP key and a bitcoin signing key. Given that a person's digital identity can become compromised, I would argue that each citizen should in fact be required to have several means of verification, such as

• PGP key
• Bitcoin address for signing
• Bitmessage address for communication
• i2p bote address for communication

For many situations, it might only be necessary to use one to prove identity, but for others like voting, perhaps 3 identity tests would be required. What worries me is that if you lose your computer, and don't have a backup, what can you do? Maybe there needs to be some way out, such as a hash of a super-long passphrase. (just thinking aloud...)