A nexus market address inside a signed message

A PGP signed message is a plain text block with a signature under it. The signature says that whoever holds the key wrote exactly the bytes above the signature. Readers use this as a surface for a nexus market address because a signature catches a change in the address that a plain post cannot.

What it is

A signed message has three parts. A header that marks the start of the signed content. The signed content itself, which for this surface is a plain text block that contains the address. A footer that holds a signature block a reader can verify against the key of whoever signed it. The three parts travel together as one file.

The message can be posted on a forum, sent in a mail, dropped on a paste site or handed over on a stick. Any surface that preserves the exact bytes preserves the signature. A surface that reflows the text, that trims trailing whitespace, or that changes the encoding may break the signature even though the visible text still reads the same.

Lifeline

What the signature covers

• The exact bytes of the signed content, so any character change in the address body is a verify failure.
• The link between the string and the key, so a reader who trusts the key trusts the string as one the key signed.
• The order of the fields inside the block, because the signature is over the whole content, not over the address alone.
• The absence of a change since the signing, because the verify tool reports fail on any change no matter how small.

What the signature does not say

• It does not say the string is the current one. A message signed six months ago verifies today and may point at an address that has since rotated.
• It does not say who the key holder is, only that the same key signed the message that signed prior ones. A reader who has never verified the key is trusting a name on the block.
• It does not say the site the reader is about to open is honest, only that the string in the block is the string the key signed.
• It does not say the block was published in one place versus another, since a signed block copies cleanly between surfaces.

How a reader verifies

A reader who wants the guarantee that a signed message offers has to run a verify. That means saving the block, pointing a PGP tool at it, and reading the verify output. The tool reports either a good signature from a key with a fingerprint the reader can compare, or a bad signature, or a good signature from a key the tool does not know. Only the first of those is a fresh proof of anything.

A reader who reads a signed block on a page and does not run the verify is reading the message as ordinary text. The signature block below the address is decoration in that case, not proof. A dossier on this surface notes that the value of the signature is only realised at the verify step.

When the signed block ages

A signed message ages only in the sense that the world around it moves. The bytes are the same on day one and on day one hundred. The address they name may have rotated on day fifty. A verify still passes because the signature is still over the same bytes. The reader who saw the pass and opened the address is opening a string the signer wrote and no longer runs. A well maintained signer refreshes the block when the address rotates, and dates the block in relative terms inside the signed content.

Engagement

Discover more