/[storm]/storm/doc/dartboard/pointer_identities--benja/idea.rst
ViewVC logotype

Diff of /storm/doc/dartboard/pointer_identities--benja/idea.rst

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.4 by benja, Thu Jul 10 01:51:14 2003 UTC revision 1.5 by benja, Wed Sep 10 13:20:27 2003 UTC
# Line 36  who has obtained your key, and thus, the Line 36  who has obtained your key, and thus, the
36  any (cryptographic) thing that you can do.  any (cryptographic) thing that you can do.
37    
38    
 What timestamping does  
 ----------------------  
   
 One important technique here is timestamping. When  
 signatures aren't timestamped, once the key is  
 compromised, no signatures signed by this key  
 can be trusted any more: There's no way to verify  
 they were created before the key was revoked.  
   
 If signatures are timestamped, you can verify  
 that a signature was created before the key  
 was revoked. So, you cannot create new signatures  
 (the problem above isn't completely solved),  
 but the old signatures don't become invalid.  
   
 Unfortunately, the good methods for timestamping  
 have been heavily patented (by `Surety, Inc.`__).  
   
 __ http://www.surety.com/  
   
 Here's a simple, patentless timestamping  
 technology (there was a patent, but it's been  
 overturned):  
   
     There is a Trusted Third Party (TTP) which is  
     trusted by everybody. To obtain a timestamp,  
     submit a hash of your document to the TTP.  
     The TTP will sign a statement like, "Hash H  
     was submitted on 2003-07-10." Showing the  
     TTP's signature proves that the document  
     really existed on that date.  
   
 Of course, the TTP could be fraudulent.  
   
 Here's a much better system:  
   
     There is a central timestamping service (TS).  
     To obtain a timestamp, submit its hash to the TS.  
     The TS operates in a sequence of "rounds," say,  
     one minute long. It builds a hash tree of all  
     documents submitted in one round. Showing the chain  
     of hashes required to authenticate your document  
     as part of the hash proves that your document  
     existed during that timestamping round.  
   
     Each round includes the hash of the previous round,  
     so each round certifies the previous round. Once  
     a week or so, the TS publishes the current round's  
     hash in a widely-witnessed manner (e.g., in an  
     important newspaper). Thus, even if one doesn't trust  
     the TS or anybody on the network at all, the age  
     of a document can be proven (well enough that it  
     should stand up in court) with a resolution of  
     one week (in the example).  
   
 Unfortunately, this one's patented.  
   
   
39  Using a public key infrastructure (PKI)?  Using a public key infrastructure (PKI)?
40  ----------------------------------------  ----------------------------------------
41    
# Line 231  without having to trust somebody: Becaus Line 173  without having to trust somebody: Becaus
173  guarantee that your private key will not be exposed,  guarantee that your private key will not be exposed,
174  you need to give somebody else the right to assign  you need to give somebody else the right to assign
175  you a new key; which means you need to trust them  you a new key; which means you need to trust them
 not to assign your key to someone else.  
176    not to assign your key to someone else.
177    
178    
179    Non-repudiability
180    =================
181    
182    Now, an important consideration here is
183    *non-repudiability*: the inability to sign a message
184    today and say tomorrow, "No, it wasn't me!"
185    
186    Repudiability is a problem in public-key cryptography
187    when keys expire oor are revoked. If anybody could
188    have a copy of the corresponding private key,
189    a signature given with it isn't worth anything-- even
190    if it was given *before* the key expired, because
191    we cannot prove that.
192    
193    In our context, repudiability results in two problems:
194    
195    - Web page authors can claim they never published
196      a version of their page which they really *did*
197      publish.
198    - Parent authorities deny the history of their
199      child authorities. I.e., a parent authority changes
200      the child authority's key to one that the parent
201      authority controls; it doesn't sign the blocks
202      that the child authority had signed, so all the
203      blocks signed by the child authority are invalidated
204      and all history of the data is lost.
205    
206    Normally, timestamping is used to proof the validity
207    of signatures after the key was revoked.
208    
209    
210    How timestamping works
211    ----------------------
212    
213    The trick with timestamping is,
214    if signatures are timestamped, you can verify
215    that a signature was created *before* the key
216    was revoked.
217    
218    Unfortunately, the good methods for timestamping
219    have been heavily patented (by `Surety, Inc.`__).
220    
221    __ http://www.surety.com/
222    
223    Here's a simple, patentless timestamping
224    technology (there was a patent, but it's been
225    overturned):
226    
227        There is a Trusted Third Party (TTP) which is
228        trusted by everybody. To obtain a timestamp,
229        submit a hash of your document to the TTP.
230        The TTP will sign a statement like, "Hash H
231        was submitted on 2003-07-10." Showing the
232        TTP's signature proves that the document
233        really existed on that date.
234    
235    Of course, the TTP could be fraudulent.
236    
237    Here's a much better system:
238    
239        There is a central timestamping service (TS).
240        To obtain a timestamp, submit its hash to the TS.
241        The TS operates in a sequence of "rounds," say,
242        one minute long. It builds a hash tree of all
243        documents submitted in one round. Showing the chain
244        of hashes required to authenticate your document
245        as part of the hash proves that your document
246        existed during that timestamping round.
247    
248        Each round includes the hash of the previous round,
249        so each round certifies the previous round. Once
250        a week or so, the TS publishes the current round's
251        hash in a widely-witnessed manner (e.g., in an
252        important newspaper). Thus, even if one doesn't trust
253        the TS or anybody on the network at all, the age
254        of a document can be proven (well enough that it
255        should stand up in court) with a resolution of
256        one week (in the example).
257    
258    Unfortunately, this one's patented.
259    
260    
261    So what can we do?
262    ------------------
263    
264    Well, first of all, we need some way to keep signatures
265    valid even after the key that originally signed them
266    has expired (or been revoked) and been replaced by
267    a new key, without having to take every signature given
268    with the old key and giving it again with the new key.
269    
270    The key, here, is to

Legend:
Removed from v.1.4  
changed lines
  Added in v.1.5

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26