Tag Info

Hot answers tagged

7

First things first. What's the problem you are trying to solve ? What is the attack model ? We cannot tell whether a protocol achieves a given goal if the said goal has not been given. Apparently, you are dissatisfied with Time Stamp Authorities as they are commonly used. Let's see what TSA do and on what security property they rely. A TSA emits time ...


6

I think you could use any web site operated by a reputable company that supports access over SSL. The one quirk is that the list of certificate authorities that might sign their certificate could change. For example if you retrieve https://www.google.com/ you'll get something like: HTTP/1.0 200 OK Date: Tue, 06 Dec 2011 17:02:40 GMT Expires: -1 ...


4

A CRL is a signed object, just like a certificate. This is why they need not be covered by the actual document signature. However, for long-term archival, they need to be timestamped. The theoretical background is the following: At a given time T, you may validate certificates and verify signatures by using just-downloaded CRL, which give guarantee about ...


4

A certificate for a Time Stamp Authority is accepted as such only if it contains an Extended Key Usage extension which itself advertises the specific id-kp-timeStamping object identifier (aka 1.3.6.1.5.5.7.3.8). Though Authenticode time stamps do not follow the RFC 3161 format, the rules on the TSA certificate are still the same (see section 2.3). There is ...


4

Just last week I heard of this Proof of Existence service that makes a secure digest of your file and gets it added to the public Bitcoin blockchain. So henceforth and forevermore (or until Bitcoin is cracked or abandoned), you'll have publicly-certified, publicly-verifiable proof that THAT particular instance of your file existed at that time. Even if the ...


4

Digital signatures "expire" because a signature is performed with a private key and verified against the corresponding public key. The public key is linked to an identity (e.g. a legally defined individual) through certificates. The usual standard for certificates (X.509) specifies that certificates expire. Beyond the expiration date, the certificate shall ...


3

Time stamping is meant to provide a verifiable proof that a given piece of data "existed" at some past date. One widespread time stamping protocol is described in RFC 3161: technically, the TSA (Time Stamping Authority) computes a digital signature on a structure which includes the current date (at the time of signature, as known by the TSA) and a hash value ...


3

Your best approach would be to secure multiple signatures from different trusted authorities. In case one of the private keys is compromised, the file could still be validated. This will incur additional costs, but increase resilience to certificate revocation. Or you could also establish a (more costly yet) procedure of periodic certificate revalidation ...


2

If you are ready to make an explicit request every time you want a signed time token, then you may as well request a regular time stamp. There are a number of free time stamping services around here, operated by CA for use with Authenticode. For instance, at that URL: http://timestamp.globalsign.com/scripts/timstamp.dll there appears to be a TSA which ...


2

Much like with public key crytography, where you are relying upon some trusted authority for identity, there are timestamp authorities. An organization can setup one internally or could rely on a trusted third party (or multiple trusted third parties) to sign a document. If the timestamp authority is trusted, then you can provide reasonable assurance of ...


2

When a certificate is revoked, the CRL contains the revocation date which tells at which date the certificate became "invalid". Indirectly, it specifies that the certificate was fine up to that date. For instance, if a private key is compromised after a burglary, the security camera recordings will be used to determine at which hour the key was stolen, and ...


2

A file is just a collection of bytes. It cannot do something to itself on its own. You need an access restricting application, or use what is available. Because it is an excel document, any weird solution you come up with can be circumvented just by saving it locally unprotected or copy pasting. But if you still want to at least try, even if it isn't ...


2

If I understand what you are asking, it seems to me you are looking for a File Integrity Monitoring solution. Are you familiar with FIMs, or have you researched them? Do you think that fits what you are looking for? Not sure what budget you are working with, but Tripwire is popular FIM vendor.


1

This is exactly what Microsoft's IRM (Information Rights Management) product is designed to address. However, as pointed out by others, the file on its own cannot achieve what you are trying to do, so you will need some infrastructure, which MSFT calls the Rights Management Server (with the delightful irony of being Rich Stallman's initials). And this ...


1

Short answer: in general, no. Long answer: the timestamp is a digitally signed data and it contains nothing that should be private on its own. It can't be reused and, as every other aspect of the system is properly conceived, cannot be counterfeit. The critical element is that the timestamp comes from an authority that is trusted by both the initial signer ...


1

It's impossible to protect some file for some time. Intrinsically, the file doesn't have any property that will allow it to know whether it's January, 1st, 2010 or 30-Feb-2050 (if February will have 30 days in 2050). What "could" know the time is the program opening it. In your case, Excel. But a program itself doesn't know about time either. It would need ...


1

You cannot always get an exact answer in forensics. Sometimes the result is a time range of possibility. That said, you can get exact answers sometimes. For your scenario, it depends on what version of Windows was used to create and maintain this volume. NTFS has long supported journaling (short term logging) in the file named $LogFile in the root of ...


1

You can see it in the computer events. You need to switch on auditing feature in group policies. This is what I used to do. I had a corporate network and the workstations were connected to a domain controller (server 2008). I had a file server that users had access to(which was also connected to the same domain). I turned on the auditing logs for a ...


1

I can set the clock on my computer (server) to any time, and there's no way for software running on it to know that this is the wrong time, so proving a timestamp is difficult. One approach is that you could produce a hash chain, but this only means that you've hashed things in a certain order, you're still not able to prove at exactly what point you've ...


1

One possible solution is to make a cryptographic hash, e.g. SHA256, of whatever data you want to use the timestamp with and then publish that hash; maybe on the internet which includes saving by the wayback machine or google cache, etc., or have it signed by a trusted party. In many cases, the person whose potential later lawsuit you want to defend against ...


1

The ICMP timestamp response contains the remote host's date and time. This information could theoretically be used against some systems to exploit weak time-based random number generators in other services


1

A easy to use, intuitive, and corporate and court friendly implementation of digital certificates and digital signed timestamps in in Adobe's acrobat. You can use any digital certificate and you can easily configure it to use an RFC 3161 timestamp authority. The digital signature and timestamp is stored in a metadata and there is built in functionality for ...


1

Please see other answers on this site that provide resources on secure timestamping: On-line cryptographically signed date/time? Signature and Timestamp for Long Term Document Archival Question Whic one is a good service of timestamp? [closed] Geographic equivilent of RFC 3161 (X.509 PKI Time-stamp Protocol) and on Crypto.SE: How are timestamps ...


1

Google Search Free one that has been around forever: http://www.itconsult.co.uk/stamper.htm Aside from that, your first paragraph is hard for me to understand. Your 3rd paragraph seems brilliant for preventing future-time signature. A hash of your data + a timestamped and signed revocation response from a CA does provide great confidence that the message ...



Only top voted, non community-wiki answers of a minimum length are eligible