Interesting times… we’re at a point where anyone with a bit of AI experience can generate pretty realistic footage or anyone else. If you want to know if a video was made by me, well there’s a 35 year old solution to the rescue.

Here, I’ll detail how you can verify content made by me, and provide some instructions for any creators who want to give themselves a bit of forgery protection in the same way.

Public key cryptography, namely OpenPGP , lets us generate key pairs–one public and one private–that may be used to have private conversations and/or authenticate that any digital content actually comes from the person with the private key.

I have published a public key which you can dowload there or here and use to verify anything I sign with the corresponding private key.

The idea is that, using this, you can verify that a video (or anything else I sign) really comes from me. What it cannot do is prove the video is real or that I didn’t use AI.

So, the signature only shows that I’m saying this is my content. For the rest, you either trust me or you don’t, but if it’s used like this you can at least know that it’s not some 3rd party forgery.

The crypto verifies the key, only you can verify that it’s mine (ideally by meeting up in person, like at the next Hackaday Supercon).

The TLDR mental model

With PGP:

• the private key: is held by one person, and used to encrypt or sign stuff going out
• the public key: is distributed to anyone, and used to encrypt things destined for the private key holder, and to verify signatures
• the signature is a receipt over a specific bunch of bits. Change one bit of the file and the receipt fails.

So the signature is like the wax seal on a letter. The wax doesn’t prove the lette is true, only that a particular stamp is untouched.

What you need

Three ingredients:

1) A program to do the crypto

For Windows, Gpg4win/Kleopatra seems good. GNU Privacy Guard for Mac and Linux, though there’s also a KDE app if you like GUIs.

2) The public key you want to use to verify

Mine can be downloaded here.

With gpg, you would then do the following.

gpg --import patdeegan-pubkey.asc

Then you can do

gpg --fingerprint "Pat Deegan"

Mine should be:
DAF4 CB0E 63B5 25C1 BAEA 7906 0C42 482C FF40 CC5D

Or just

gpg --fingerprint

to list the fingerprints of all keys present

Finally, to verify it, you can just run

gpg --verify

and paste in the complete signature block, from “—–BEGIN PGP SIGNED MESSAGE—–” to “—–END PGP SIGNATURE—–“

Press Ctrl-D to indicate you’ve finished pasting, or just save the whole signed message to a file and run

gpg --verify /tmp/signed.txt

You may get a message that the “key is not certified with a trusted signature”. If you want to mark it as trusted, you’ll need a key-pair of your own.

Do:

gpg --generate-key

follow the directions, selecting the options as you please. Usually, default is good enough.

Then, tell gpg to locally sign the key with my fingerprint

gpg --lsign-key DAF4CB0E63B525C1BAEA79060C42482CFF40CC5D

For Creators

If you create content and would like to do the same, it’s pretty simple.

You’ll need the same program as described above, and to generate some keys if you don’t already have them. My advice is to keep the number of bits pretty high (quantum will destroy all cryptoooooo) and a sane, but not too early, expiration.

Then, if your content is text or some other digital format you will be sharing, then save the file exactly as you’ll be distributing and run

gpg -u 'yourIDemail@example.com' --clearsign /path/to/file

For something like a video on youtube, a couple of notes: first, the digital content is viewed rather than distributed and anyway it’s all munged by optimization. So my technique is to include at least some part of the spoken contents and the URL (because otherwise, the end of the video or anything you didn’t include in the sig could be changed).

Now youtube is annoying in 2 ways:

1) any links to youtube are shortened and converted to something else; and
2) the “—–” around the BEGIN and END sections are munged: one of them is eaten up by stupid strike-through that you can’t turn off.

So what I’m doing is breaking up the URL into something still usable

youtube . com/watch?v=ihiDrIOV9uc

rather than https://www.youtube.com/watch?v=ihiDrIOV9uc and then I add an extra “-” to the six places where there are “—–” so that, when people copy, you still have the right number in the buffer.

And that’s it.