Subject: FW: why we need sequences of timestamps

From: Tobias Gondrom <[email-masked]>
Date: Mon, 5 Apr 2004 11:04:02 +0200

Hello LTANS,
 
somehow a message from Uli got lost. :-(
So he asked me to forward it to the community. 
 
Tobias
 
Ps.: I will try to find out what went wrong. 

-----Original Message-----
From: Ulrich pordesch [mailto:[email-masked]] 
Sent: Sunday, April 04, 2004 13:07
To: [email-masked]
Subject: why we need sequences of timestamps

Santosh 

envisage the following court case (we conducted such cases last fall in an
academic study, using real lawyers and judges - and not only with an
ERS-similar method, but also others):

Doctor A operated on patient B in year 2000. Afterwards, he wrote and signed
an operation report.  In 2020, the patient sues the hospital for damages in
the value of millions, because allegedly there was an error in the
operation.  This alleged error then lead to her later disability. Let us
assume that the doctor's signature used the algorithm RSA-1024, 

which became insecure in the year 2007.  Furthermore, in 2020, signatures
created with such a weak key can be easily forged. Therefore, at the time of
the legal suit, anyone could forge the document and signature.

The signature has become worthless. It is only of value, if it is provable
that it existed before 2007. What can the hospital do to be able to convince
a judge?  Which method should it adopt?  How can LTANS help the hospital?

Case 1 
------ 
The hospital does not want to use an external archive service provider,
rather it wants to provide its own in-house archive services.

ERS: By 2020, its archive system created a chain of, e.g., 3 time-stamps.
The time-stamps were retrieved according to RFC 3126 and from a legal,
accredited time-stamp authority.  The court verifies this change of
time-stamps, namely the Evidence Record.  Because the 

time-stamps were timely renewed, before the algorithms became weak
(according to the yearly published list of trustworthy algorithms) and
because the used TSA is demonstrably accredited and thus was inspected, the
evidence will be recognised.  Actually, the court must recognise it, since
there are such evidence rules, which virtually force it to do so.

n-of-m: As far as I see it, Shamir's scheme does not offer any value for
this case.  The hospital could, at best, present to the court a confirmation
from its own system, that says the document was added to its system in 2000.
This is hardly credible.  The judge will send an expert to the hospital, who
will search through the hospital's archive 

and protocols.  This can be very expensive and the chance of success is at
best poor. 

Case 2 
------ 
The hospital uses an external service provider, a TAA, let's call it
Uli-TAA. 

ERS: The provider creates an evidence record, as above, using time-stamps
from an accredited TSA.  There is no difference in the court case.  It will
be recognised, that the archive time-stamps are correct and were timely
generated and thus, the signature existed before 2007 and cannot have been
forged.

n-of-m: The hospital can only present the confirmation from Uli-TAA, who
asserts, that the document was archived in 2000.  Since this was not a
legally recognised method, it is difficult to prove the trustworthiness of
Uli-TAA during the last 20 years.

Case 3 
------ 
The hospital uses 2 external providers, Uli-TAA and Santosh-TAA, and splits
its messages.  As Antje already said, she is not overwelmed with enthusiasm
for this, since her costs will double. However, let's assume that two
providers are used.  Furthermore, let's also assume that it is provable that
the two pieces belong together, that is, that random 

document pieces cannot combined together (I have not checked, whether this
requirement of the provability of uniqueness exists, but let's assume it).

ERS: Both TAAS offer their evidence records and it will be proven that both
pieces were archived in 2000.  The fact that the pieces belong together and
thus the original document existed in 2000 is part of our assumptions.  I
must point out that for the case of the splitting, there is no binding rule
for the judge, and we thus do not know, whether the 

judge will actually make such a ruling or not. 

n-of-m: The judge receives a confirmation from Uli-TAA and Santosh-TAA, that
the document existed in their systems in 2000.  It could be that the judge
is convinced.  But perhaps he will say: I cannot estimate trustworthyness of
Ulis and Santoshs TAAs. The hospital must 

prove that Uli-TAA and Santosh-TAA were completely trustworthy in the last
20 years. Good luck with that. 

I haven't even considered the special cases, where Uli-TAA is bought by
Alexij-TAA (or Santosh-TAA), and thus after 20 years no longer exists and
cannot be asked for confirmations.

Short summary: Archive time stamp sequences provides us with a high volume
suitable, secure method that is provable in court.  This is true since the
security of the method only relies on the accreditation of the algorithms
and time-stamp machines (TSAs).  There is no foundation for the distribution
of documents and the trustworthiness of TAAs.  One 

could define rules for which policies TAAs must have, which security
measures they must use and how they will be regularly audited etc. However,
I tend to rule out that one can achieve a comparable level of security
through this manner.

Where one could make further considerations is the combination of both
methods.  Additional confirmations from the TAAs, saying that they had the
document or piece, could be in specific cases an alternative for ERS, in
particular, in the case that something went wrong during the time-stamp
renewal.

Uli

---

From: "Carl Wallace" <[email-masked]>
Date: Mon, 5 Apr 2004 07:45:20 -0400

Uli,
 
I don't think using 1-of-1 scenarios is a good basis for comparing the two
approaches.  In any case, why it is necessary to view this as an ERS vs.
n-of-m decision?  n-of-m could be used in conjunction with ERS to provide
data confidentiality.  Combining n-of-m with a keyless timestamp scheme
could be a nice solution.  
 
What about the patient's preservation of evidence?  It may be difficult for
the patient to manage encryption keys that enable confidentiality of the
patient's medical data stored in a commercial archive.  I doubt the patient
would trust the hospital to maintain all copies of the relevant data.  
 
Are there any results of the study you mentioned available online?  
 
Carl

  _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Tobias Gondrom
Sent: Monday, April 05, 2004 5:04 AM
To: [email-masked]'
Subject: FW: why we need sequences of timestamps

Hello LTANS,

Tobias

-----Original Message-----
From: Ulrich pordesch [mailto:[email-masked]] 
Sent: Sunday, April 04, 2004 13:07
To: [email-masked]
Subject: why we need sequences of timestamps

Santosh 

Case 1 
------ 

Case 2 
------ 

Case 3 
------ 

Uli

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 5 Apr 2004 08:33:26 -0400

In addition to what Carl and Peter said, please note that n of m does not
prevent subscribers and the TAAs from obtaining time stamps or TAAs from
asserting time.
 
If not n of m, at least two TAAs even in time stamp case are required in
order to protect against a single TAA from intentionally corrupting the
data.  If a single TAA under the control of or as a contractor to an
organization being sued had all the data, it can always manipulate prior
trust anchors and messages.  Thus, an independent source of trust anchors
may be required even in the case of 3161 time stamp refresh.
 
n of m does the same thing without requiring time stamp.

-----Original Message-----

Hello LTANS,

Tobias

-----Original Message-----
From: Ulrich pordesch [mailto:[email-masked]] 
Sent: Sunday, April 04, 2004 13:07
To: [email-masked]
Subject: why we need sequences of timestamps

Santosh 

Case 1 
------ 

Case 2 
------ 

Case 3 
------ 

Uli

---

From: Brian Hunter <[email-masked]>
Date: Tue, 06 Apr 2004 11:03:17 +0200

Santosh Chokhani wrote:
> In addition to what Carl and Peter said, please note that n of m does 
> not prevent subscribers and the TAAs from obtaining time stamps or TAAs 
> from asserting time.
>  
> trust anchors and messages.  Thus, an independent source of trust 
> anchors may be required even in the case of 3161 time stamp refresh.

I think a key difference between the two schemes is where the trust lies 
when a dispute arises in the future.  In both schemes, the client has a 
contract with the TAA to properly archive his data, in the ERS case, 
this is one TAA, who could intentionally inproperly archive the data so 
that it is invalid in the future.

But the trust of the system is during the dispute.  Here, no trust is 
allocated to the TAA.  The client simply has the ERS data structures, 
containing time-stamps from *trusted* TSAs, who had no access to the 
documents, nor a financial incentive to function improperly.  With n of 
m, the judge must then trust the TAAs (n of them), that they all 
functioned correctly, in terms of guidelines as well as the software 
systems.

Uli's point was whether a judge would trust the systems of the TAAs (a 
TAA system is much more complex than a simple TSA).  Currently there are 
laws in Germany stating that the TSA approach is legally binding.

Of course, a hybrid approach could solve both the trust as well as 
confidentiality issues.  But if the time-stamp solution is removed as a 
mandatory part, we are then unsure of the legal value of the evidential 
proof.

Brian

>     From: [email-masked]
>     [mailto:[email-masked]] On Behalf Of Tobias Gondrom

---

From: Brian Hunter <[email-masked]>
Date: Tue, 06 Apr 2004 11:17:31 +0200

Carl:

Carl Wallace wrote:
> Uli,
>  
> I don't think using 1-of-1 scenarios is a good basis for comparing the 
> two approaches.  In any case, why it is necessary to view this as an ERS 
> vs. n-of-m decision?  n-of-m could be used in conjunction with ERS to 
> provide data confidentiality.  Combining n-of-m with a keyless timestamp 
> scheme could be a nice solution. 

Adding n of m on the client side could be used to alleviate his key 
management issues (, provided that the recombination of the n parts is 
shown to maintain the uniqueness of the document and hence the 
non-repudiation).

> What about the patient's preservation of evidence?  It may be difficult 
> for the patient to manage encryption keys that enable confidentiality of 
> the patient's medical data stored in a commercial archive.  I doubt the 
> patient would trust the hospital to maintain all copies of the relevant 
> data. 

Uli's example was from the point of view of the hospital, who has to 
archive millions of documents a year, thus it needs an efficient system. 
  The patient would be another type of client, and would not use the 
hospital's system.

Brian

> Are there any results of the study you mentioned available online? 
...

---

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 6 Apr 2004 09:28:21 -0400

Brian:

The trust in the ERS model DOES depend on the TAA.  While the trust anchor
for the outermost timestamp can and should be verified independent of the
TAA, all the inner timestamps and data are vulnerable to cryptanalysis and
hence TAA manipulation.  Thus, the real transaction or document in dispute
can always be manipulated.

Just like the TSA does not have data or vested interest, the various TAAs
should not either and with n of m just like hash, they have meaningless
string of bits which they can not manipulate to achieve a specific outcome
other than screwing up the integrity.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Brian Hunter
Sent: Tuesday, April 06, 2004 5:03 AM
To: Santosh Chokhani
Cc: 'Tobias Gondrom'; [email-masked]
Subject: Re: why we need sequences of timestamps

Brian