Subject: RE: Initial requirements for long-term archive I-D - coments fro m aleksej - Confidentiality

From: Tobias Gondrom <[email-masked]>
Date: Wed, 28 Jan 2004 14:41:20 +0100

> > Confidentiality is something that will be probably one of the very 
> > important issues when independent Archive Providers want to offe this 
> > service to end users and smaller companies. (One mechanism I could 
> > imagine is that the users are submitting encrypted data/documents and 
> > solve most of there urgent problems with that.)
> 
> To what degree do you trust your provider of the operating 
> system and the machine processor to not have a backdoor in 
> the system which will be activated when things happen in a 
> environment of a 'competitor'.

My personal answer would be to trust only things that can be evaluated and
that are actually evaluated (e.g. source from LINUX, large community working
with Windows and ISV-Firewalls). In general I would say that customers rely
on the reputation of a system, on results of independent tests (including
hackers and audits) and some of the promises of the provider.

> Encryption may be a solution for short term, otherwise in 
> real paranoia you need to physically split the data and store 
> then at places where you are reasonably sure that the 
> operators cannot cheat together without leaving some trace. 
> There are also various possible combinations of 
> in/out-sourcing. what seems important is that the 
> provider/operator of the service has an auditable system in a 
> very large sense.  

Maybe Peter is right and you simply have to trust your provider. :-/
(at least you have a contract and probably pay your provider for the service
and the provider could gain some additional trust by independent audits)

Still I am very sure we have to provide the ability to store (and provide
evidence for) encrypted data. For many people this will be the first way to
trust an external provider.
(And in some countries it might also be forbidden to let the data even only
theoretically be accessible to other persons)