36 |
any (cryptographic) thing that you can do. |
any (cryptographic) thing that you can do. |
37 |
|
|
38 |
|
|
|
What timestamping does |
|
|
---------------------- |
|
|
|
|
|
One important technique here is timestamping. When |
|
|
signatures aren't timestamped, once the key is |
|
|
compromised, no signatures signed by this key |
|
|
can be trusted any more: There's no way to verify |
|
|
they were created before the key was revoked. |
|
|
|
|
|
If signatures are timestamped, you can verify |
|
|
that a signature was created before the key |
|
|
was revoked. So, you cannot create new signatures |
|
|
(the problem above isn't completely solved), |
|
|
but the old signatures don't become invalid. |
|
|
|
|
|
Unfortunately, the good methods for timestamping |
|
|
have been heavily patented (by `Surety, Inc.`__). |
|
|
|
|
|
__ http://www.surety.com/ |
|
|
|
|
|
Here's a simple, patentless timestamping |
|
|
technology (there was a patent, but it's been |
|
|
overturned): |
|
|
|
|
|
There is a Trusted Third Party (TTP) which is |
|
|
trusted by everybody. To obtain a timestamp, |
|
|
submit a hash of your document to the TTP. |
|
|
The TTP will sign a statement like, "Hash H |
|
|
was submitted on 2003-07-10." Showing the |
|
|
TTP's signature proves that the document |
|
|
really existed on that date. |
|
|
|
|
|
Of course, the TTP could be fraudulent. |
|
|
|
|
|
Here's a much better system: |
|
|
|
|
|
There is a central timestamping service (TS). |
|
|
To obtain a timestamp, submit its hash to the TS. |
|
|
The TS operates in a sequence of "rounds," say, |
|
|
one minute long. It builds a hash tree of all |
|
|
documents submitted in one round. Showing the chain |
|
|
of hashes required to authenticate your document |
|
|
as part of the hash proves that your document |
|
|
existed during that timestamping round. |
|
|
|
|
|
Each round includes the hash of the previous round, |
|
|
so each round certifies the previous round. Once |
|
|
a week or so, the TS publishes the current round's |
|
|
hash in a widely-witnessed manner (e.g., in an |
|
|
important newspaper). Thus, even if one doesn't trust |
|
|
the TS or anybody on the network at all, the age |
|
|
of a document can be proven (well enough that it |
|
|
should stand up in court) with a resolution of |
|
|
one week (in the example). |
|
|
|
|
|
Unfortunately, this one's patented. |
|
|
|
|
|
|
|
39 |
Using a public key infrastructure (PKI)? |
Using a public key infrastructure (PKI)? |
40 |
---------------------------------------- |
---------------------------------------- |
41 |
|
|
173 |
guarantee that your private key will not be exposed, |
guarantee that your private key will not be exposed, |
174 |
you need to give somebody else the right to assign |
you need to give somebody else the right to assign |
175 |
you a new key; which means you need to trust them |
you a new key; which means you need to trust them |
|
not to assign your key to someone else. |
|
176 |
|
not to assign your key to someone else. |
177 |
|
|
178 |
|
|
179 |
|
Non-repudiability |
180 |
|
================= |
181 |
|
|
182 |
|
Now, an important consideration here is |
183 |
|
*non-repudiability*: the inability to sign a message |
184 |
|
today and say tomorrow, "No, it wasn't me!" |
185 |
|
|
186 |
|
Repudiability is a problem in public-key cryptography |
187 |
|
when keys expire oor are revoked. If anybody could |
188 |
|
have a copy of the corresponding private key, |
189 |
|
a signature given with it isn't worth anything-- even |
190 |
|
if it was given *before* the key expired, because |
191 |
|
we cannot prove that. |
192 |
|
|
193 |
|
In our context, repudiability results in two problems: |
194 |
|
|
195 |
|
- Web page authors can claim they never published |
196 |
|
a version of their page which they really *did* |
197 |
|
publish. |
198 |
|
- Parent authorities deny the history of their |
199 |
|
child authorities. I.e., a parent authority changes |
200 |
|
the child authority's key to one that the parent |
201 |
|
authority controls; it doesn't sign the blocks |
202 |
|
that the child authority had signed, so all the |
203 |
|
blocks signed by the child authority are invalidated |
204 |
|
and all history of the data is lost. |
205 |
|
|
206 |
|
Normally, timestamping is used to proof the validity |
207 |
|
of signatures after the key was revoked. |
208 |
|
|
209 |
|
|
210 |
|
How timestamping works |
211 |
|
---------------------- |
212 |
|
|
213 |
|
The trick with timestamping is, |
214 |
|
if signatures are timestamped, you can verify |
215 |
|
that a signature was created *before* the key |
216 |
|
was revoked. |
217 |
|
|
218 |
|
Unfortunately, the good methods for timestamping |
219 |
|
have been heavily patented (by `Surety, Inc.`__). |
220 |
|
|
221 |
|
__ http://www.surety.com/ |
222 |
|
|
223 |
|
Here's a simple, patentless timestamping |
224 |
|
technology (there was a patent, but it's been |
225 |
|
overturned): |
226 |
|
|
227 |
|
There is a Trusted Third Party (TTP) which is |
228 |
|
trusted by everybody. To obtain a timestamp, |
229 |
|
submit a hash of your document to the TTP. |
230 |
|
The TTP will sign a statement like, "Hash H |
231 |
|
was submitted on 2003-07-10." Showing the |
232 |
|
TTP's signature proves that the document |
233 |
|
really existed on that date. |
234 |
|
|
235 |
|
Of course, the TTP could be fraudulent. |
236 |
|
|
237 |
|
Here's a much better system: |
238 |
|
|
239 |
|
There is a central timestamping service (TS). |
240 |
|
To obtain a timestamp, submit its hash to the TS. |
241 |
|
The TS operates in a sequence of "rounds," say, |
242 |
|
one minute long. It builds a hash tree of all |
243 |
|
documents submitted in one round. Showing the chain |
244 |
|
of hashes required to authenticate your document |
245 |
|
as part of the hash proves that your document |
246 |
|
existed during that timestamping round. |
247 |
|
|
248 |
|
Each round includes the hash of the previous round, |
249 |
|
so each round certifies the previous round. Once |
250 |
|
a week or so, the TS publishes the current round's |
251 |
|
hash in a widely-witnessed manner (e.g., in an |
252 |
|
important newspaper). Thus, even if one doesn't trust |
253 |
|
the TS or anybody on the network at all, the age |
254 |
|
of a document can be proven (well enough that it |
255 |
|
should stand up in court) with a resolution of |
256 |
|
one week (in the example). |
257 |
|
|
258 |
|
Unfortunately, this one's patented. |
259 |
|
|
260 |
|
|
261 |
|
So what can we do? |
262 |
|
------------------ |
263 |
|
|
264 |
|
Well, first of all, we need some way to keep signatures |
265 |
|
valid even after the key that originally signed them |
266 |
|
has expired (or been revoked) and been replaced by |
267 |
|
a new key, without having to take every signature given |
268 |
|
with the old key and giving it again with the new key. |
269 |
|
|
270 |
|
The key, here, is to |