Subject: RE: Alternatives for Long Term Archiving - conclusion ?

From: Tobias Gondrom <[email-masked]>
Date: Wed, 21 Apr 2004 19:32:50 +0200

Santosh:

The TAA can try to manipulate every data it stores. 
But _not__unnoticed_ when you verify the "archive time stamp chains". 

Just to demonstrate it with an example:
At first you store your document and probably along or within it signatures
that are e.g. based an RSA-1024.
At the beginning initially the archive service will apply an archive
timestamp using a trusted third party timestamp provider (as they are
available today) with e.g. RSA-2048.

Let's say some years later RSA-1024 is no longer secure but RSA-2048 is
still sufficient - just as an example. 

The TAA can manipulate the stored in the following ways:
A) delete the archive Timestamps - not of much help as then no judge would
belive the document be valid as the used algorithms can meanwhile easily be
forged. 
B) delete the archive Timestamps and manipulate the signatures at the
document. - the same as A

C) try to manipulate the document and still keep the RSA_2048 timestamp. -
Not possible as 
manipulations of the document will be noticable through the applied archive
timestamp with RSA-2048. TAA can not manipulate the signatures applied to
the document or the document itself as long as the still secure RSA-2048
from the trusted third party is protecting the document. 

D) It could try to delete the old timestamp, manipulate the data of the
document or the signatures and apply a new archive timestamp. Here any judge
will get the information that the new timestamp has been applied _after_ the
old signatures could be broken so he would definitely not trust the
document.

I hope I wrote my arguments in an understandable way. 

Tobias

> Tobias:
> 
> The way time stamp refresh works, the TAA can manipulate the 
> data, trust anchors and time stamps to obtain a time stamp.
> 
> The ERS approach does not have cryptographic protection 
> against that class of attack.
> 
> -----Original Message-----
> From: Tobias Gondrom [mailto:[email-masked]] 
> Sent: Thursday, April 08, 2004 1:23 PM
> To: 'Santosh Chokhani'
> Cc: [email-masked]
> Subject: RE: Alternatives for Long Term Archiving - conclusion ?
> Importance: Low
> 
> 
> Santosh:
> 
> There seems to be a misunderstanding:
> 
> You are right TAA is within the organization and can for this 
> not be fully trusted - as a 3rd party time stamp server. 
> Based on the concept of the TAA and ERS we ensure the 
> security based on the time stamps from the trustable third 
> party/source. 
> 
> These timestamps will ensure the integrity like layers around 
> the documents and all more inner layers (with timestamps 
> based on meanwhile weak algorithms).
> 
> It is _not_ possible for the TAA to manipulate the inner data 
> as the new timestamp (that can be trusted) will ensure the 
> integrity of the document and all up to appliance of the last 
> timestamp already existant timestamps. This includes the 
> possibility of loosing the security of a hash algorithm (as 
> long as there exists at least a new reliable hash algorithm) 
> as the document and all up to then existing timestamps are 
> together rehashed with a new valid hash algorithm. 
> 
> You can _proof_ that the system is secure while 
> renewing/changing hash or PK algorithms over time. 
> For the course of time please consult the email from Libor 
> Dostalek from Friday 4/2/2004 (subject: RE: Our objections to 
> draft ERS) where he described the chain of proof brilliantly.
> 
> So I can not see any problems with courts.
> 
> Best regards
> 
> 	Tobias
> 
> 
> 
> > -----Original Message-----
> > From: Santosh Chokhani [mailto:[email-masked]]
> > Sent: Thursday, April 08, 2004 19:01
> > To: 'Tobias Gondrom'; [email-masked]
> > Subject: RE: Alternatives for Long Term Archiving - conclusion ?
> > 
> > 
> > Tobias:
> > 
> > You all are ignoring the fact that as you lay out, the TAA 
> is a single 
> > source of authority to vouch for the document.  You all 
> also seem to 
> > say that TAA is within the organization.
> > 
> > This could lead to problems in some courts.
> > 
> > Please note that the time stamp authority is only good for the 
> > outermost time stamp.  Due to cryptanalysis etc., inner time stamps 
> > may be manipulated by the TAA.
> > 
> > -----Original Message-----
> > From: [email-masked] 
> > [mailto:[email-masked]]
> > On Behalf Of Tobias Gondrom
> > Sent: Thursday, April 08, 2004 12:43 PM
> > To: [email-masked]
> > Subject: RE: Alternatives for Long Term Archiving - conclusion ?
> > Importance: High
> > 
> > 
> > 
> > Dear all,
> > 
> > Personally I fully go with Brian, Aleksej, Uli, Antje and 
> Michael. I 
> > can see that n-of-m has some quite interesting aspects but feel the 
> > same that it is quite academic concenring current needs and 
> business.
> > 
> > I agree that there is one advantage of n-of-m over the 
> current model, 
> > that is when it comes to the point that we have no hash 
> algorithms and 
> > no PK algorithms at _all_. At the moment we are working quite fine 
> > with PK and hash algorithms and the time stamps from PKIX are in 
> > practical use - so I would like to rely on them.
> > 
> > Second, the distribution is very expensive and AFAIK from 
> my contacts 
> > to users and customers will most probably not be accepted. 
> (we are all 
> > just
> > humans)
> > 
> > 
> > As our goal is to develop standards that we think are best for the 
> > world _and_ will be _used_.  I feel that all of the arguments are 
> > exchanged concerning the topic and so I would like to get to an 
> > conclusion.
> > 
> > >From what I read I feel that there might be rough 
> consensus to reject
> > >the
> > proposal of n-of-m for this draft. We can pick it up as a 
> future topic 
> > or add-on for LTANS if we are able to demonstrate the need and the 
> > business use and have done our homework with the first 
> drafts mid of 
> > this year.
> > 
> > 
> > Am I asking to early or just please give me your statement ?
> > 
> > 
> > Best regards and happy easter
> > 
> > 	Tobias
> > 
> > 
> > (Chair of LTANS)
> > 
> > 
> > 
> > > -----Original Message-----
> > > From: A. Jerman Blazic [mailto:[email-masked]]
> > > Sent: Thursday, April 08, 2004 15:43
> > > To: [email-masked]
> > > Subject: RE: Alternatives for Long Term Archiving
> > > 
> > > 
> > > 
> > > Of course, that is the main point. We should consider
> > demands (at the
> > > moment) and focus on them. Multiple parties scenario does 
> not exist 
> > > currently... At least to my knowledge. But future infrastructures 
> > > might do that (n/m).
> > > 
> > > > -----Original Message-----
> > > > From: Santosh Chokhani [mailto:[email-masked]]
> > > > Sent: Thursday, April 08, 2004 3:28 PM
> > > > To: 'A. Jerman Blazic'; [email-masked]
> > > > Subject: RE: Alternatives for Long Term Archiving
> > > > 
> > > > 
> > > > The n of m approach is proposed when you use multiple parties as
> > > > trust store.
> > > > 
> > > > If you feel that you need to store your own data and 
> can defend in
> > > > court time stamps (all of which may be subject to cryptanalysis 
> > > > except the current one), then you do not need multiple third 
> > > > parties.
> > > > 
> > > > -----Original Message-----
> > > > From: [email-masked]
> > > > [mailto:[email-masked]]
> > > > On Behalf Of A. Jerman Blazic
> > > > Sent: Thursday, April 08, 2004 9:08 AM
> > > > To: [email-masked]
> > > > Subject: RE: Alternatives for Long Term Archiving
> > > > 
> > > > 
> > > > 
> > > > Dear all,
> > > > 
> > > > I have been following the discussion for some time and did go
> > > > through the n/m scenario and I have to add my position 
> (also as a 
> > > > technology provider).
> > > > 
> > > > As stated a couple of times before n/m solves some
> > critical problems
> > > > (confidentiality) but mostly in scenarios when trusted 
> archive is
> > > > presented as an outsourcing service (here I really liked Uli's 
> > > > scenarios). Within an organization n/m approach does not
> > deliver a
> > > > single benefit, since redundancy and disaster recovery is
> > solved by
> > > > other approaches/technology and building a "new 
> instance" taking 
> > > > care of redundancy is a wrong direction. Also one 
> should keep in 
> > > > mind that many records do already exist today and 
> transformation 
> > > > using n/m approaches are to demanding and especially form
> > the point
> > > > of view that DMS systems or docbases are not something that will
> > > > be implemented with the trusted archive but they DO 
> exist already, 
> > > > archival standards should take care mostly of collecting 
> > > > complementary data for unquestioned record conservation over 
> > > > defined or undefined period of time. The approach being 
> > > > implemented today by technology providers and 
> organizations with 
> > > > docbases is therefore based on deployment of archival 
> interfaces 
> > > > operating directly on existing records by producing 
> conservation 
> > > > relevant data. Three major points needs to be addressed ASAP: 
> > > > archive interaction, archival meta and archival complementary 
> > > > data. Present systems try to build sets of data (mainly trust 
> > > > anchors) on existing or incoming records. Standardizing such 
> > > > (archival) data is a must, since it can not rely on specific 
> > > > technology and this is where the problem really exist at the 
> > > > moment. Data, meta data and complementary data must be 
> transparent 
> > > > of underlying technology and they must be combined with 
> seamless 
> > > > mechanisms for proving integrity on independent platforms or in 
> > > > other words, they must be based on standardized semantic.
> > > > 
> > > > Regards
> > > > 
> > > > aleksej
> > > > 
> > > > > -----Original Message-----
> > > > > From: [email-masked]
> > > > > [mailto:[email-masked]] On Behalf Of Michael
> > > > Tielemann
> > > > > Sent: Thursday, April 08, 2004 2:14 PM
> > > > > To: [email-masked]
> > > > > Subject: Alternatives for Long Term Archiving
> > > > > 
> > > > > 
> > > > > 
> > > > > Dear all,
> > > > > 
> > > > > in my opinion the recently discussed n:m distribution is an
> > > > > academically interesting approach. But I fear that in
> > > > practice there
> > > > > is no chance to run such a model. Spreading signed 
> data is much
> > > > > expensive in communication, storing, retrieving etc. Sure,
> > > > there is a
> > > > > benfit in security and evidence, but the overhead is in any
> > > > industrial
> > > > > context not feasable. Implementing distributed locations is to
> > > > > expensive in the sense of hardware, stuff, building,
> > > > several DMS (?),
> > > > > backup, disaster recovery, managing responsebility, etc.
> > > > > 
> > > > > I guess we need, lets say a local store which serves all
> > > neccessary
> > > > > tasks.  This allows a more practicable implementation and
> > > modelling
> > > > > for any company or application.
> > > > > 
> > > > > At our site we have a huge amount of stored documents,
> > > > splitting this
> > > > > mass up to several locations with all dependencies would be a
> > > > > nightmare.
> > > > > 
> > > > > Regards
> > > > > -Michael
> > > > > 
> > > > 
> > > 
> > 
> 
>

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 21 Apr 2004 13:49:40 -0400

Tobias:

My basic point is that a TAA who serves the trust anchors also, can
manipulate the data, but if the trust anchors are gotten from a different
trusted source, data manipulation can be detected.

-----Original Message-----
From: Tobias Gondrom [mailto:[email-masked]] 
Sent: Wednesday, April 21, 2004 1:33 PM
To: 'Santosh Chokhani'
Cc: [email-masked]
Subject: RE: Alternatives for Long Term Archiving - conclusion ?
Importance: Low

Santosh:

Just to demonstrate it with an example:
At first you store your document and probably along or within it signatures
that are e.g. based an RSA-1024. At the beginning initially the archive
service will apply an archive timestamp using a trusted third party
timestamp provider (as they are available today) with e.g. RSA-2048.

Tobias