integration discussion - blockchain address and contract proofs

What follows are a bunch of random thoughts I had while reading other discussions about Bitcoin and Ethereum proofs.

@pipermerriam originally suggested Ethereum address ownership verification in #518 in September 2015, in the form of "a blessed contract with published and audited source code that users could send a transaction with a signed blob of data to it, which could then be independently verified by anyone running an ethereum node."

I can think of four ways that an Ethereum address proof could be executed:

1. One-Way Verification by signing the Ethereum public address. Demonstrates that you CLAIM ownership of the address. This is how the Bitcoin address verification currently works.
2. Two-Way Verification by signing a proof statement with the Ethereum private key, then signing the signed proof statement with your signed PGP key and publishing it somewhere; should be possible using web3.js, as discussed in ethereum/web3.js#392
3. Two-Way Verification by transacting with The Official Verification Contract. The prover sends a signed blob of data to the contract.
4. Two-Way Verification by transacting with an address that is generated, e.g. from the prover's key and keybase username or something:

keybaseuser="brandoncurtis"
ethaddress="0xd19FDa898E1e1F3b1e372Bf131257e0f4a9EF7DB"
shasum=`printf '%s' "$ethaddress""$keybaseuser" | sha256sum | cut -d ' ' -f 1`
etheverificationaddress=`python3 -c "print(hex(int(format(int('$shasum',16),'b')[:160],2)))"`
geth attach --exec "eth.sendTransaction( { from: $ethaddress, to: $ethverificationaddress, value: 1 } )"

Likewise, there are at least two ways that this proof could be machine-verified:

1. By hooking into an Ethereum client via JSON-RPC and parsing the blockchain itself;
2. By using the API of a service like Etherchain, which does the blockchain scraping for you. (this service could lie to you, so this adds another link to the trust chain)

In the case of Ethereum, what you're proving is actually kind of tricky. The logic chain for a two-way verification on a cryptocurrency address based on a transaction is something like this:

User A transacts from Address X
∴ User A has transact authority from Address X
∴ User A holds the private key for Address X

Unlike Bitcoin where the links in this chain generally hold, Ethereum is designed to be an ecosystem where contracts call other contracts call other contracts. If I receive a transaction at Address Y from Address X, all that demonstrates is that User A has a mechanism for getting Address X to transact with Address Y, and says nothing about whether User A 'owns' Address X or holds the Address X private key.

Perhaps even more interesting is the prospect of proving ownership of an Ethereum contract itself. This would probably involve hashing and signing something and publishing it right into the contract at creation.

No implementation files or tests are named. Start by reviewing the four Ethereum proof approaches, web3.js#392, the Etherchain API, and the geth JSON-RPC example; this issue is done only after a concrete, agreed proof design and implementation scope are defined.