What should I say when I "sign" a message, to prove that I own an address? This reddit thread discusses a user who lost some coins and is trying to prove that he owns that address.

There was a question in how he signed, and what he signed in the message fields, since it's easy to become an imposter the way he did it.

Question

What should (and should not) be written in the message field to prove ownership of a particular address?

Examples might include:
- Date
- Nonce?
- ID such as Username, email address, full name, pgp public key, etc.
- To
The problem stated here is that the message signed was only four uppercase letters: "DJFC." Apparently this is the person's Reddit username, but it's also a very tiny amount of data which can often be problematic. Mathematically speaking, the more entropy in your signed message the greater confidence it inspires. Simply signing your username is also not typically enough to reasonably prove that the poster and the signer are the same person.

I would personally take a hint from the sorts of cryptographic handshakes that automated systems use. Typically these involve a server-side nonce and a client-side nonce. Each of you should choose a large chunk of random data from a good entropy source (random.org, etc), publish those nonces publicly and then sign a message which includes both nonces as well as your intended message.

Having another entity provide a nonce for you to sign is known as a "challenge" and ensures the validity of the signature by providing a large amount of input entropy that the signer can have no prior knowledge of. Including your own nonce and publishing it publicly alongside the signed message proves that the person signing the message also controls the posting account. For example:

The challenge:

twentyseventy: DJFC, please sign the following nonce in addition to a nonce of your choosing:
ff 44 45 1a 5d 78 3a 19 a8 45 cf 83 05 cf 86 a1 
64 1b 1e cf 8e ad 69 3a f2 5f 6e 12 12 2e af 76 


The response:

TheDJFC: I have chosen the following nonce:
96 c4 41 1a 5e 27 22 0c 64 15 6d 3e 02 ea bd e4 
99 dc 47 82 ba 30 2c db 49 e2 7a bb 87 c4 5f 32 

---- BEGIN SIGNED TEXT ----
ff 44 45 1a 5d 78 3a 19 a8 45 cf 83 05 cf 86 a1 
64 1b 1e cf 8e ad 69 3a f2 5f 6e 12 12 2e af 76 
96 c4 41 1a 5e 27 22 0c 64 15 6d 3e 02 ea bd e4 
99 dc 47 82 ba 30 2c db 49 e2 7a bb 87 c4 5f 32 
---- END SIGNED TEXT ----
&lt;insert signature here&gt;


If security is less paramount, one could perhaps forego the complexities of a nonce-based system and simply sign a much more detailed message. For example, instead of:

Message: DJFC


One could sign a message like:

Message: 2014-06-02 11:43AM PST. I, TheDJFC, in response to a request to be found at the
specified URL, sign this message as proof of ownership of the specified Bitcoin address.
Address: 1P6iT6SJe4fZkKdzZBvMGoNj4KLnpSgNSp
URL: http://www.reddit.com/r/Bitcoin/comments/273vi2/if_you_just_received_800_bitcoin_out_of_the_blue/chx4wjc


Why all this drama? Well, I can think of a half-dozen ways off the top of my head to trick someone else into signing an arbitrary message with their Bitcoin address. Without the context of a Reddit user named "TheDJFC" that four letter "DJFC" string just looks like random letters, easily confusable with a nonce. It's also worth noting that the message was only signed with one of the input addresses, while the transaction in question references multiple addresses. In such cases, signatures from all addresses used would be preferable, especially where such large amounts of money are involved.