How can I verify someone controls the private key behind a segwit address?

Question

With a legacy P2PKH address, signmessage and verifymessage can be used to verify that the other party actually controls the bitcoin address in question. However, P2SH, P2WPKH and P2WSH addresses throw an error for signmessage, and we don't know when or if this will be made to work. So, another procedure is necessary if we want to accomplish the same thing with segwit.

As a work-around, I could have the owner of the segwit address send 1 satoshi to a verification address that I create in my wallet just for them. But that's a hassle and it's off-putting to them. And what if they want their satoshi back? =D; that would be a hassle.

Is there a way to accomplish the same proof of ownership without them having to send me coin?

I prefer an answer using the json rpc on my end (But failing that, I also have access to bitwasp, and failing that, I'm open to anything that runs in php), and the easiest (manual) procedure on their end. These are non-technical ordinary users. I might be able to nudge them into using a particular wallet if that wallet has a feature which will allow them to implement the idea in a better work-around.

I didn't tag this with json-rpc because I don't know what technology the answer will come from.

Answer 1

First of all, the operations signmessage and verifymessage allow to prove that whoever creates a signed message with this address specified can receive Bitcoins in that address. This does not prove the user owns the private key (corresponding to the public key the address is generated from) as this address' private key could be handled by a third-party wallet service (like an exchange), so the exchange would be able to create this signed message too (and the user may not have access to the private key).

With P2SH addresses you cannot create signed messages as they are Pay-to-script-hash (P2SH) addresses. This means using this addresses in outputs can only be unlocked by specifying a valid redeem script in a transaction that spends this outputs where the adress is specified. Therefore, not necessarily public keys must be present in the mentioned script (like a HTLC) and a signing scheme can't be developed as it would require to reveal the redeem script which may cause a serious security issue (like in HTLC after the timelock is over).

A fix you could try in order to get the same functionality is to create a transaction that spends this UTXO where the address is specified with a minimal amount of 1 satoshi and no outputs. This way who does this can prove they can receive Bitcoins in that address.

But notice the security issues revealing a redeem script means (for instance this would not be appropiate for a HTLC but could be for a multisig where every one agrees to create that transaction). This problem replies also to the problem with performing this operations with P2WSH addresses as they share the same main problem.

With native P2WPKH (and P2SH-P2WPKH), a new signing scheme had to be defined due to technical issues. This is already partially implemented (just implemented with P2SH-P2WPKH addresses) in Trezor's web wallet and under development in Bitcoin Core.