I'm looking for a good way to publish data along with a digital signature (and ideally a timestamp) which is as easy as possible to verify via software run locally on public data.
For example, imagine an election administrator who wants to publish election data which is to be audited (totals by candidate by precinct). We ideally don't want to require the public to have to acquire much if any special or proprietary software. Signatures which adhere to an open standard, can be validated on PC, Mac, Linux, and can be generated by open source software are preferred.
The data has to remain machine-readable
, so a pdf isn't suitable, so if pdf is used, the data would be in attachments to the pdf.
E.g. if we generate XML Signatures (e.g. for IEEE 1622-2011 Election Markup Language (EML) files for elections), is there standard functionality in any common browsers or operating systems to validate the signatures? Is the user interface clear enough to make it clear to the user when the data looks good, when it is suspicious, and how to deal with common issues?
Alternatives (and concerns):
- RFC 3161 - Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) - what cross-platform clients are friendly?
- OriginStamp, backed by Bitcoin blockchain (charge for rapid turnaround)
- Signed PDF overview with attached data files: can the timestamps be verified and trusted? Can users be tricked via bogus certificates into
- Publish link to data and hash of it via various timestamped social networks: Keybase (backed by good crypto specs), Twitter (popular), ...
- XML Signatures
- Publish SHA-256 hash in the newspaper (How to describe verification steps to the user?)
- Use a jar (signed zip) and jarsigner (is there a nice GUI for verifying jar signatures? X.509 PATH validation?)
- Use OpenOffice (A hassle to install)
- CMS or S-MIME (How can we publish an S-MIME message with attachments - public IMAP?)
- Use gpg (but admins need to get in the PGP web of trust, and users need to learn to understand it)
- Use s-http (a pity https://www.rfc-editor.org/rfc/rfc2660 never took off....)
- Use Excel (are there free clients that can check the signature? Open source software to generate it via a script?)
- "Just serve from a secure web site" (doesn't deal with a variety of attacks)
- Updated list of options with some newer ones, and clarified my goal (in the age of the cloud) of an approach that can be verified via locally-run software. We're learning more and more that web servers are vulnerable to attack, and there are advantages to distributing signed data.
- Note that EML and even XML are losing favor these days