Subject: Alternatives for Long Term Archiving

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 24 Mar 2004 13:36:54 -0500

One of the ideas that came out of Seoul meeting (thanks to Larry Masinter)
is to use a key-less approach to trusted archive.  The client who has vested
interest in the secure storage of archived data, can use Shamir's n of m
scheme to submit the archived data to m archive facilities.  m must be
greater than 1 and should be selected based on availability needs. n must be
greater than 1, less than or equal to m, and should be selected based on the
desired degree of protection against collusion.
 
If this scheme is used, we may not need any cryptographic operations at the
TAA.
 
Under this scheme, the LTANS WG would need to still define various protocol
for submission, deletion, and retrieval.  if the idea is acceptable to the
group, it could be the preferred or one of the approaches to perform
archiving.
 
As the current LTANS documents in the various stages state or imply, the
trusted archive can continue to be used to submit any class of data.
 
One advantage of the approach is that any document split is not sensitive
even if the original document is sensitive.  However, if the document
requires confidentiality, assuming an adversary could be monitoring the
channels to collect all the splits, the submission and retrieval of the
split should be provided transmission security using techniques such as SSL
or session encryption.  This still is lot easier than needing to provide
long-term encryption for stored data.
 
To further illustrate one usage of the approach, a client with the need to
provide long-term, non-repudiation of a transaction, could obtain current
time stamp, all the trust anchor, certificates, revocation information
relevant to signatures and time stamp, and package them using TBD record
format and create m splits.  These m split could be sent to m TAAs using
TLS.  Each TLS could provide a pointer to its split.
 
When there is a need to retrieve the evidence, n splits could be retrieved
from n TAAs that are available and can be combined to validate the
signatures on the transaction as well as the time stamp.
 
The approach also offers some redundancy in case some TAAs are not
available, data is corrupted, or the challenger does not trust some of the
TAAs.

Santosh Chokhani 
Orion Security Solutions, Inc. 
1489 Chain Bridge Road, Suite 300 
McLean, Virginia 22101 
(703) 917-0060  Ext. 35 (voice) 
(703) 917-0260 (Fax) 
[email-masked] 
Visit our Web site 
http://www.orionsec.com <http://www.orionsec.com/>

---

From: Larry Masinter <[email-masked]>
Date: Wed, 24 Mar 2004 14:21:03 -0800

There seems to be quite a bit of research in this area. For example, see
http://www.pdl.cmu.edu/PDL-FTP/PASIS/SISW2002.pdf. I think there are still
open issues about how to manage trust over the long term, and even identity.

Larry

---

From: Brian Hunter <[email-masked]>
Date: Fri, 26 Mar 2004 10:36:31 +0100

I think that a keyless approach could be an ideal approach, however, I 
don't see Shamir's scheme as solving all of our problems.  First, the 
complexity of the system would increase.  This starts with the 
distribution of the original document, and then the possible 
redistribution of the document as TAAs are removed or added.  Such 
functionality would add to the complexity of the (server-server) protocols.

Furthermore, stricter access control must be ensured, such that an 
attacker can't simply retrieve n parts of the document from the TAAs. 
Using the current encryption scheme, an attacker would first have to 
bypass the access control of the (single) TAA, and then have to break 
the encryption of the document.  Thus, the security focus of the systems 
are different, one is strictly based upon access control, the other on 
access control and encryption.  One could even argue that no access 
control is needed for the evidence records, since they only contain a 
hash of the document and reveal nothing about its content.

The cost to archive a document would increase, likely linearly based on 
the size of m.  How many clients want to pay m times more for a service? 
(unless the alternatives are shown to be insufficient)  Furthermore, 
each TAA would probably have to be, at least in Germany, accredited, 
since it is attesting for the document insertion time (and integrity). 
Accreditation is not needed by the TAAs in the ERS solution, only 
accredited TSA(s) are needed.

I believe that this distribution approach could be useful, for at least 
particular cases, but am unsure if it is suitable today for a generic 
archive service that needs to be efficient and cost effective for large 
volumes of documents.  Thus, I still think (based on what has been 
presented so far) that ERS should be continued, in order to get a 
needed, standard, viable solution in the near future, and the 
distribution approach could be further investigated, refined and then in 
the future be evaluated whether it is added to the LTANS approach as the 
new recommended method, or as an optional method recommended for 
specific use cases.

Brian

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 26 Mar 2004 08:54:00 -0500

Brian:

See responses in-line in [].

-----Original Message-----
From: Brian Hunter [mailto:[email-masked]] 
Sent: Friday, March 26, 2004 4:37 AM
To: Santosh Chokhani
Cc: [email-masked]
Subject: Re: Alternatives for Long Term Archiving

I think that a keyless approach could be an ideal approach, however, I 
don't see Shamir's scheme as solving all of our problems.  First, the 
complexity of the system would increase.

[I think the complexity of the client will increase.  But, the TAAs will
become very, very simply.  In my judgment the overall system complexity will
reduce since there is no encryption, signature, timestamp, time refresh
etc., but a simply n of m split only one time]

This starts with the 

[Actually, when TAAs are removed or added, n of m scheme may be better
suited to handle this.  I have not fully grasped Shamir's technique, but it
lets you add new shares if some properties hold.  Removal on the other hand
can be handled in two ways.  n of m gives you some margin for removing some
TAs (may be up to m-n).  Alternatively, since there are no keys involved it
will be easier to move to a newly created TAA.  In the current proposal, the
whole stuff has to be with another TAA]

[n of m does not prevent you from encrypting the document.  I just wanted to
point out that confidentiality against TAAs and against an eavesdropper can
be easily achieved.  If you think all TAAs' access controls can be bypassed
(not just one TAA's), which I doubt, you can encrypt the document a la
current proposal.

[Cost may be a concern.  But, hopefully even 2 of 2 might suffice.  Also,
since TAAs are simple, cost per archival should offset some of the costs.
This is one of the reasons, I do not want to standardize on current proposal
alone or n of m alone, but see if there is a way to accommodate both and
have most aspects of transactions and storage record common.]

[I would like to read the paper Larry pointed to and then make a judgment if
ERS or both ERS and n of m should be considered.  I am not proposing that
ERS be not part of the approach.].

Brian

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 29 Mar 2004 09:08:26 -0500

Larry:
 
I have reviewed this paper.  Here are some of my observations:

.         The paper is oriented towards confidentiality

.         Paper deals with multiple archive servers and what do do if some
are decommissioned or corrupted and  others need to be commissioned.  We
currently do not address the need for multiple servers and we do not handle
decommissioning and commissioning.  While the work done to date in LTANS
does not address this as a requirement or solution, I think having n of m
and then redistributing shares to create n' of m' should be part of our
standard.

.         The paper deals with integrity of share broadcast that Micali,
Feldman etc have provided.  This should not be of concern to us since we can
use TLS for secrecy and integrity of current data.  My concern largely here
is that of patent

.         Speaking of patents, I hope the redistribution scheme by Jajodia
or this work are not under patent.

I also did not see any outstanding issues with us going forward with many of
the features of n of m.  I would suggest that we move out with this work.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Larry Masinter
Sent: Wednesday, March 24, 2004 5:21 PM
To: 'Santosh Chokhani'
Cc: [email-masked]
Subject: RE: Alternatives for Long Term Archiving

Larry

---

From: Larry Masinter <[email-masked]>
Date: Mon, 29 Mar 2004 12:18:25 -0800

I think my main point is that the standard for
the network protocol for accessing and interacting
with a long term archive and notary (distributed)
service should not be tied to the mechanism that
the service uses for insuring long term archives
and non-repudiation.

The current requirements document seems to be too
tightly tied to the architecture of the underlying
repository and the nature of the mechanisms by
which it supplies services.

Personally, I think that we should look for
"long term archives" solutions that do not
rely on algorithmic complexity and one-way
functions as the mechanism for insuring privacy,
integrity, etc.

Larry

---

From: Brian Hunter <[email-masked]>
Date: Wed, 31 Mar 2004 13:40:58 +0200

Larry or Santosh,

Could someone tell me how the n of m scheme replaces the need of an 
(accredited) time-stamping or time-marking service, when the date of 
document existance must be proved?  Is it assumed that each TAA simply 
states (and signs) when the document existed and when n TAAs state the 
same date, this date is correct and trustworthy?

Regards,
Brian