Suppose Alice owns an onion service and wants to verify she owns the service. One solution might be:
- Alice encrypts her pub_key using her service's prv_key and sends to Bob.
- Bob decrypts using the service's pub_key.
- Bob can verify the decrypted value (pub_key) matches the pub_key he used to decrypt, so Bob trusts that Alice actually has the onion service's private key.
My question is twofold:
- Is there an existing, better way to verify Alice's claim?
- What are the actual terminal commands Alice and Bob would run to perform such a verification? (asymmetric encryption/decryption using tor keys)
(I have reviewed the advanced client-auth documentation but it does not address how asymmetric encryption/decryption can be manually done using tor keys.)