Timeline for How to know whether a textfile has been edited or tampered with?
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 12, 2016 at 16:21 | comment | added | Joshua | You could just send them the .asc file of the detached signature to have it signed. | |
| Jan 12, 2016 at 16:17 | comment | added | Josef | @Joshua well, they are using PGP/GPG, but you can't use your GPG/PGP and just get a timestamp. You have to send them the file (so encrypt it before!) and then they will sign it with PGP and you have to trust them to use the correct date and don't lose the keys. Seems not really suited for this use case. I didn't know this service, so thanks for mentioning it exists! | |
| Jan 12, 2016 at 16:12 | comment | added | Joshua | @Josef: itconsult.co.uk/stamper.htm | |
| Jan 12, 2016 at 12:41 | comment | added | Josef | @Joshua PGP has no secure timestamps. | |
| Jan 11, 2016 at 21:49 | comment | added | Joshua | Why not just sign the .xml file with PGP? | |
| Jan 11, 2016 at 19:29 | history | edited | StackzOfZtuff | CC BY-SA 3.0 |
+links
|
| Jan 11, 2016 at 11:30 | comment | added | Stephane | @billc.cn Actually, no, you don't have to use a compatible file format. That's what I explained in my post: you can either envelope the data in PGP/SMIME or simply use a detached signature | |
| Jan 11, 2016 at 10:19 | comment | added | billc.cn | +1 for the timestamp especially since many court cases have key evidences made inadmissible due to the computers producing them having incorrect time set. Many major x509 certificate authorities provide timestamp services, but you'll have to be using a compatible file format. | |
| Jan 11, 2016 at 9:24 | comment | added | Stephane | All digital signature scheme will rely, at one level or another, on trust placed on a third party: it is necessary to assert the identity of the key used for signature. That doesn't mean that you need to place much trust, in 3rd parties, tough: for instance, the timestamping authority only is responsible to guaratee that, at a given time, a specific datum already existed (through its hash). | |
| Jan 10, 2016 at 22:29 | comment | added | Buge | You could embed the hash of the signature into the bitcoin blockchain, then you don't have to trust a third party. It's not quite free though. | |
| Jan 10, 2016 at 10:22 | comment | added | Peteris | @BlacklightShining it does, but it prevents very real attack vectors - for example, a malicious insider (e.g. your own technicians) or an attacker with access to all your keys will still be unable to fake the timestamps, and if that third party is malicious or compromised then by itself it is not sufficient to disclose or modify your data. A drawback is that the network connection to that timestamp server can expose how much signatures you're doing and when exactly you're doing so, depending on your situation it may be irrelevant or dangerous. | |
| Jan 9, 2016 at 22:52 | comment | added | Blacklight Shining | Ahh, so it requires trust to be placed in a third party. | |
| Jan 9, 2016 at 22:18 | comment | added | Stephane | The protocol is described in rfc 3161. Basically, you take a hash of your signature data, send it to a secure timestamp server that sends you back a signed version of the hash. You then add that to your signature. | |
| Jan 9, 2016 at 21:27 | comment | added | Blacklight Shining | Secure timestamp? How do you prove that a signature occurred at a specific time? | |
| Jan 9, 2016 at 14:25 | history | answered | Stephane | CC BY-SA 3.0 |