<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Nov 19, 2014, at 1:26 PM, Tony Arcieri <<a href="mailto:bascule@gmail.com" class="">bascule@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote">On Wed, Nov 19, 2014 at 10:22 AM, Tony Arcieri <span dir="ltr" class=""><<a href="mailto:bascule@gmail.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=bascule@gmail.com&cc=&bcc=&su=&body=','_blank');return false;" class="">bascule@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class=""><div class="gmail_extra"><span class=""><div class="gmail_quote">I was thinking more of Twitter</div></span></div></div></blockquote><div class=""><br class=""></div><div class="">Specifically, why not tweet a key fingerprint and linked to a signed proof instead of tweeting a signature?</div></div></div></div></div></blockquote><br class=""></div><div>The tweeted hash is computed over the key fingerprint and the signature. </div><div><br class=""></div><div>The tweet is the (truncated) SHA-256 of a PGP message. The PGP message, once</div><div>uncompressed, has 3 packets: (1) a signature header; (2) the literal data containing</div><div>a JSON object; and (3) the signature itself. </div><div><br class=""></div><div>Your PGP key fingerprint is specified in packet (2), along with other stuff about your</div><div>Keybase identity and your signature chain.</div><div><br class=""></div><div>I was proposing to add the SHA-2 (or SHA-3 or Shake256) of your key fingerprint to </div><div>the JSON object in packet (2), to mitigate the SHA-1 2nd preimage attacks that you proposed.</div><div><br class=""></div></body></html>