Is there any way to prove ownership of a hidden service without revealing it's private key? Maybe signing a message with the key? Also take into account that the service is not hosting anything that serves up data in the normal sense. So I can't just simply put something on my homepage.
I can't find anything that would indicate this has been asked before, or whether a solution has been implemented. (Or, indeed, if there's an easier way than the idea presented below.) Other members of the group may know otherwise.
At a high level, you probably have one of two options:
- Sign something with your services's private key and let users decrypt it with the services's public key. (i.e. Your message-signing idea).
- Let users encrypt something with the services's public key, then have the service decrypt it and present the result back to them.
A hidden service's public key is available. You have to do a bit of work to get it - as explained in the below thread - but it's there. (The onus would, however, be on the user to obtain the key. Without some sort of service doing the heavy lifting of finding it, this might be more hassle than it's worth for the average user.)
(With regards to the first option, it should be noted that RSA does support encryption with the private key, rather than just the decryption you're used to thinking of.)
Finally, your site is only as "genuine" as the security of your private key, and should the key fall into the wrong hands, a bad guy could "prove ownership" of your site.