I'm looking for a good way to publish data along with a digital signature (and ideally a timestamp) which is as easy as possible to verify.
For example, imagine an election administrator who wants to publish election data which is to be audited (totals by candidate by precinct). We ideally don't want to require the public to have to acquire much if any special or proprietary software. Signatures which adhere to an open standard, can be validated on PC, Mac, Linux, and can be generated by open source software are preferred.
The data has to remain machine-readable
, so a pdf isn't suitable, so if pdf is used, the data would be in attachments to the pdf.
E.g. if we generate XML Signatures (e.g. for IEEE 1622-2011 Election Markup Language (EML) files for elections), is there standard functionality in any common browsers or operating systems to validate the signatures? Is the user interface clear enough to make it clear to the user when the data looks good, when it is suspicious, and how to deal with common issues?
Other alternatives (and concerns):
- Publish SHA-256 hash in the newspaper (How to describe verification steps to the user?)
- Use a jar (signed zip) and jarsigner (is there a nice GUI for verifying jar signatures? X.509 PATH validation?)
- Use OpenOffice (A hassle to install)
- CMS or S-MIME (How can we publish an S-MIME message with attachments - public IMAP?)
- Use gpg (but admins need to get in the PGP web of trust, and users need to learn to understand it)
- Use s-http (a pity http://tools.ietf.org/html/rfc2660 never took off....)
- Use Excel (are there free clients that can check the signature? Open source software to generate it via a script?)
- "Just serve from a secure web site" (doesn't deal with a variety of attacks)