I am required to design a system where auditors can come along some time in the future, examine historic data, and be sure that the data has not changed since it was stored. I have a spec that instructs me to timestamp and sign the data when I store it, but I figure if I want to change the data in future, I can always regenerate the signature with the modified data and the original timestamp. Since the signature is generated with my certificate, there is nothing to stop me?

Any solution, it seems to me, must require that my signatures be timestamped and countersigned by a third party. In that way, a future auditor has a third party's word that the hash protecting a set of data genuinely is as old as it claims.

Do norms such as XAdES cater for this requirement? Can the certificate authority that issues my certificate date and countersign my signatures? Are there other online services that do this?


Use trusted timestamps

Have one more trusted external company timestamp and sign a hash of your content for you. There are several companies that do this for money.

You can then create a chain. Where each link of the chain links to its predecessor and each link is also signed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.