How to Verify Whether Someone Is Really Me, Chongxi

Ed25519 Public Key MCowBQYDK2VwAyEAAPB9MubdfbA6yF+rEpqVtPYCXE94/nEUh3OofiHx8c0=

• Fingerprint: f254c03b0d61f664
• Owner: Chongxi <[email protected]>
• Website: chongxi.us

If you suspect someone is impersonating Chongxi, you can send them a challenge string, for example VerifyChongxi1782050590, and ask them to sign it with the private key and return the signature value.

Then verify the signature using the public key above:

1
TMPPUB=$(mktemp)
2
TMPSIG=$(mktemp)
3
TMPMSG=$(mktemp)
4

5
echo "-----BEGIN PUBLIC KEY-----
6
MCowBQYDK2VwAyEAAPB9MubdfbA6yF+rEpqVtPYCXE94/nEUh3OofiHx8c0=
7
-----END PUBLIC KEY-----" > $TMPPUB
8

9
echo "我签名出的base64放在这" | base64 -d > $TMPSIG
10

11
echo -n "你给出的挑战字符串" > $TMPMSG
12

13
openssl pkeyutl -verify -pubin -inkey $TMPPUB -rawin -in $TMPMSG -sigfile $TMPSIG
14

15
rm -f $TMPPUB $TMPSIG $TMPMSG

If verification passes, you can confirm that the person is me

Suppose there’s someone named Jackdwh who thinks the person chatting with him isn’t the real Chongxi. Then he can ask the other party to verify: 你真是Chongxi嘛20260621221640

If the other party really is me, I will sign 7zxngFpM2/uDM1nCIBW+VWwuDnTkfqO7a52UbTX7TmJZ6KeL72SwnvoDFtxZcC2ztHjmaiw+/RCiBVECxfIfCA==

At that point Jackdwh opens a terminal and enters

1
TMPPUB=$(mktemp)
2
TMPSIG=$(mktemp)
3
TMPMSG=$(mktemp)
4

5
echo "-----BEGIN PUBLIC KEY-----
6
MCowBQYDK2VwAyEAAPB9MubdfbA6yF+rEpqVtPYCXE94/nEUh3OofiHx8c0=
7
-----END PUBLIC KEY-----" > $TMPPUB
8

9
echo "7zxngFpM2/uDM1nCIBW+VWwuDnTkfqO7a52UbTX7TmJZ6KeL72SwnvoDFtxZcC2ztHjmaiw+/RCiBVECxfIfCA==" | base64 -d > $TMPSIG
10

11
echo -n "你真是Chongxi嘛20260621221640" > $TMPMSG
12
//由于blog会自动pangu给中英文加空格，实际这里应该是没有空格的
13

14
openssl pkeyutl -verify -pubin -inkey $TMPPUB -rawin -in $TMPMSG -sigfile $TMPSIG
15

16
rm -f $TMPPUB $TMPSIG $TMPMSG

After pressing Enter, if the terminal outputs Signature Verified Successfully, then it’s confirmed to be me