Subject: RE: Initial requirements for long-term archive I-D - coments fro m aleksej - authentication

From: Peter Sylvester <[email-masked]>
Date: Wed, 28 Jan 2004 15:52:22 +0100 (MET)

> > 
> > Isn't Authentication 'at distance' but not 'in time'. 
> 
> Basically I see a problem concerning the time too. The methods of
> authentification may change during the lifetime of a document (even more
> than once). And with that you might get problems.
> Let's e.g. say you archived a contract about your newly bought house or
> something and used at the beginning user/password authentication. For the
> next 20 years you are basically probably not interested in the document and
> might even forget your password, although you still have the URL of the
> document with all the evidence records. In the future maybe even
> user/password authentication is no longer accepted by the server so you need
> something different 
> - but what is important for the system: are you the same person that stored
> the document 20 years ago ?

Even with user/password you don't make a proof that you are the person
that stored, only that some accesses who knows these values. 

There is a difference betwenn identification and authentication.

The 'user' is not your 'identification', but an means for authentication.
You long term identification are the data on your birth certificate;
thus, when you register to such a service, you have probably always
to provide some information about who you are, a copy of your
national id card or whatever. 

This identification (potentially in an anonymous form) is then 
associated by the provider with some authentication method: 
You get a user/password.  20 years later (and even earlier) you 
should be able to provide the same identification information
(or better, the the id of your grandparents) to access.

> 
> Authorisation: 
> In my understanding authorisation comes after some kind of authentication
> (i.e. at first you know the identity of the other and then you think about
> to allow him access to the data).

> A role based access control seems feasable and hopefully not to complicated.
> (Maybe added with some sercret (document id ?) generated at the time of
> storage.) 
> 
> The "judge/relevant authority" is of course on. 
> A second one will be the user who stored the data. (Of course he wants to be
> able to receive the evidence and maybe even the data he stored.)

You almost never have the situation that some data only belongs to
one person durng a long period in time. The most simplistic
authorisation model which just has a 1=1 correspondance is not
sufficient. You can die at any moment, you can delegate your
power to someone else at any time etc. 
  
> Small remark: If the trusted archive does not provide the data itself to
> normal requests, the authorisation topic might be easy, as I think the
> retrieval of evidence to a document might not be a security issue. The
> request for evidence could contain either the data or a hash-value of the
> data (as long as the hash-algorithm is still secure).

A not so small response :-)

A request to an archiver may live the following way:

- someone has archived data and received an attestions that
  contains the relevant metadata like:
  "Person XYZ has archived a contract between A, B, C concerning xxx 
  at date D in the city of L conforming to law ZZZ and application
  degree GGG etc. The concerned parties are fiscally related to FFF.
  
  The content of the document has the hash H1 with hashes h2 to Hn
  for the chapters 2 to n", 
  all that (most likely), digitally signed by the archive provider
  at the moment you receive it.

- the digital signature can be confirmed with a hash link to
  a published daily hash next day or there is an ability to present
  the attestation to the archive provider asking whether this attestation 
  is a good one by looking at his archive log.  

- If the relying parties can't agree,
  or when this is a fiscal control, etc
  a service needs to return the data. For this case
  one cannot depend on the good will of the initial
  client if the archived data are not in favor of his
  claim. Thus, a judge or even the other party may
  access. This may bring us to a requieremnt where
  the initial archiver should be able to indicate 
  "identification information" of all the
  potential concerned relying parties. This
  identification information can be persons or
  companies, but also "done at Paris" in order
  to indicate that a judge in some court in Paris
  may access.

(If hash algs are not secure, you still have physical copies
that are dated.)

---

From: "A. Jerman Blazic" <[email-masked]>
Date: Thu, 29 Jan 2004 11:21:58 +0100

> > authentification may change during the lifetime of a document (even 
> > more than once). And with that you might get problems. 
> Let's e.g. say 
> > you archived a contract about your newly bought house or 
> something and 
> > used at the beginning user/password authentication. For the next 20 
> > years you are basically probably not interested in the document and 
> > might even forget your password, although you still have the URL of 
> > the document with all the evidence records. In the future 
> maybe even 
> > user/password authentication is no longer accepted by the server so 
> > you need something different
> > - but what is important for the system: are you the same 
> person that 
> > stored the document 20 years ago ?
> 
> Even with user/password you don't make a proof that you are 
> the person that stored, only that some accesses who knows 
> these values. 
> 
> The 'user' is not your 'identification', but an means for 
> authentication. You long term identification are the data on 
> your birth certificate; thus, when you register to such a 
> service, you have probably always to provide some information 
> about who you are, a copy of your national id card or whatever. 
> 

I agree with peter completely. I also think one needs to clarify what
procedures are we discussing about. Authorization is something that
gives you power (or not) to access or use something. While
identification is something else. So in case of archival services
authorization is seen through rights to use the service or not (and of
course the level of usage). However we still must keep the fact in mind
that whatever we are archiving always belongs to somebody (something??).
So the major question is: who has the rights to access the archived
item? And after that: how do we identify the person with the acess
rights? I think this should be clarified before we can even discuss the
operational steages of the service.

My wiev is, that this two main functions might be separated (although
tightly corelated to the service), i.e. an authority identifying
subjects in an open environment or mapping the rights to a subject. For
example, as Peter stated, if I put something in the archive on behalf of
my company, who will access the same archive once I change my job? Where
are the connections between former and present employee?

Aleksej

> > A role based access control seems feasable and hopefully not to 
> > complicated. (Maybe added with some sercret (document id ?) 
> generated 
> > at the time of
> > storage.) 
> > 
> You almost never have the situation that some data only 
> belongs to one person durng a long period in time. The most 
> simplistic authorisation model which just has a 1=1 
> correspondance is not sufficient. You can die at any moment, 
> you can delegate your power to someone else at any time etc. 
>   
> > Small remark: If the trusted archive does not provide the 
> data itself 
> > to normal requests, the authorisation topic might be easy, 
> as I think 
> > the retrieval of evidence to a document might not be a 
> security issue. 
> > The request for evidence could contain either the data or a 
> hash-value 
> > of the data (as long as the hash-algorithm is still secure).
>

---

From: Alexandre Dulaunoy <[email-masked]>
Date: Thu, 29 Jan 2004 12:39:01 +0100 (CET)

> operational steages of the service.

Yes,  you are  right.  Just  for  an example,  the freearchive.org  is
setting up and the authorization is working on two methods :

- An  open  approach   (as  we  gather  free  works)   with  a  manual
  verification of  the work (on  the legal (if  the work is  free) and
  technical side (if the work permits a long-term storage)). 

- An authenticated approach where  the manual verification is bypassed
  as the submission  is coming from trusted sources  (can be people or
  other digital repositories with an OAI or alike interface). 

On the  two methods, an unique  ID is generated by  the repository for
tracking the life of the digital work. 

Freearchive is  a specific case  where all work  are frees and  can be
distributed  without  any restrictions.   I  think,  this approach  is
well-known in various public domain digital libraries. I don't know if
you can take this easily in the draft document. 

For the operational stages that seem more complicated to explain.

Thanks a lot for your work,

adulau

-- 
-- 	  	     Alexandre Dulaunoy (adulau) -- http://www.foo.be/
-- 	   http://pgp.ael.be:11371/pks/lookup?op=get&search=0x44E6CBCD
-- 	   "Knowledge can create problems, it is not through ignorance
-- 				  that we can solve them" Isaac Asimov