Subject: why we need sequences of timestamps (third trial)

From: "Ulrich Pordesch" <[email-masked]>
Date: Tue, 6 Apr 2004 09:23:12 +0200

The following message got lost twice in cyberspace. Strange to say that some
members of the list got it and posted comments. Here is the third trial for
all ...

Santosh 

envisage the following court case (we conducted such cases last fall in an
academic study, using real lawyers and judges - and not only with an
ERS-similar method, but also others):

Doctor A operated on patient B in year 2000. Afterwards, he wrote and signed
an operation report.  In 2020, the patient sues the hospital for damages in
the value of millions, because allegedly there was an error in the
operation.  This alleged error then lead to her later disability. Let us
assume that the doctor's signature used the algorithm RSA-1024, 

which became insecure in the year 2007.  Furthermore, in 2020, signatures
created with such a weak key can be easily forged. Therefore, at the time of
the legal suit, anyone could forge the document and signature.

The signature has become worthless. It is only of value, if it is provable
that it existed before 2007. What can the hospital do to be able to convince
a judge?  Which method should it adopt?  How can LTANS help the hospital?

Case 1 
------ 
The hospital does not want to use an external archive service provider,
rather it wants to provide its own in-house archive services.

ERS: By 2020, its archive system created a chain of, e.g., 3 time-stamps.
The time-stamps were retrieved according to RFC 3126 and from a legal,
accredited time-stamp authority.  The court verifies this change of
time-stamps, namely the Evidence Record.  Because the 

time-stamps were timely renewed, before the algorithms became weak
(according to the yearly published list of trustworthy algorithms) and
because the used TSA is demonstrably accredited and thus was inspected, the
evidence will be recognised.  Actually, the court must recognise it, since
there are such evidence rules, which virtually force it to do so.

n-of-m: As far as I see it, Shamir's scheme does not offer any value for
this case.  The hospital could, at best, present to the court a confirmation
from its own system, that says the document was added to its system in 2000.
This is hardly credible.  The judge will send an expert to the hospital, who
will search through the hospital's archive 

and protocols.  This can be very expensive and the chance of success is at
best poor. 

Case 2 
------ 
The hospital uses an external service provider, a TAA, let's call it
Uli-TAA. 

ERS: The provider creates an evidence record, as above, using time-stamps
from an accredited TSA.  There is no difference in the court case.  It will
be recognised, that the archive time-stamps are correct and were timely
generated and thus, the signature existed before 2007 and cannot have been
forged.

n-of-m: The hospital can only present the confirmation from Uli-TAA, who
asserts, that the document was archived in 2000.  Since this was not a
legally recognised method, it is difficult to prove the trustworthiness of
Uli-TAA during the last 20 years.

Case 3 
------ 
The hospital uses 2 external providers, Uli-TAA and Santosh-TAA, and splits
its messages.  As Antje already said, she is not overwelmed with enthusiasm
for this, since her costs will double. However, let's assume that two
providers are used.  Furthermore, let's also assume that it is provable that
the two pieces belong together, that is, that random 

document pieces cannot combined together (I have not checked, whether this
requirement of the provability of uniqueness exists, but let's assume it).

ERS: Both TAAS offer their evidence records and it will be proven that both
pieces were archived in 2000.  The fact that the pieces belong together and
thus the original document existed in 2000 is part of our assumptions.  I
must point out that for the case of the splitting, there is no binding rule
for the judge, and we thus do not know, whether the 

judge will actually make such a ruling or not. 

n-of-m: The judge receives a confirmation from Uli-TAA and Santosh-TAA, that
the document existed in their systems in 2000.  It could be that the judge
is convinced.  But perhaps he will say: I cannot estimate trustworthyness of
Ulis and Santoshs TAAs. The hospital must 

prove that Uli-TAA and Santosh-TAA were completely trustworthy in the last
20 years. Good luck with that. 

I haven't even considered the special cases, where Uli-TAA is bought by
Alexij-TAA (or Santosh-TAA), and thus after 20 years no longer exists and
cannot be asked for confirmations.

Short summary: Archive time stamp sequences provides us with a high volume
suitable, secure method that is provable in court.  This is true since the
security of the method only relies on the accreditation of the algorithms
and time-stamp machines (TSAs).  There is no foundation for the distribution
of documents and the trustworthiness of TAAs.  One 

could define rules for which policies TAAs must have, which security
measures they must use and how they will be regularly audited etc. However,
I tend to rule out that one can achieve a comparable level of security
through this manner.

Where one could make further considerations is the combination of both
methods.  Additional confirmations from the TAAs, saying that they had the
document or piece, could be in specific cases an alternative for ERS, in
particular, in the case that something went wrong during the time-stamp
renewal.

Uli