2

If using asymmetric encryption, such as ES256, is there a reason why a private key could not be discarded after signing some data?

For example with a JWT, or a file hash use for audit at a later date, is keeping the private key necessary? The idea being that we would only need the public key to verify the data is unchanged, and would not need to re-encrypt data in the future using the same key.

The closest I have read to anyone suggesting this is in a response to a key storage question.

In my view, this accomplishes a few things:

  1. Eliminates the need to have a vault or other private key storage mechanism.
  2. Makes it impossible to forge previously signed data as key would be discarded immediately.

The only potential downside I would guess is the time needed to generate keys, but using EC seemed to make that a moot point. Or is there something else I am missing?

Although never implemented, I developed a JWT authentication system in Expressjs doing this and then saving the public keys to Redis for fast verification until the JWT expired (a few minutes later).

However, I have a new use case now for signing a file to create a audit of the data, which could be years later. Nothing is encrypted and it isn't very sensitive data, but I would like to sign it so that the data can be verified as true at a later date. This data consists of the details from individual transactions that occur over time. The threat is low as the value of these transactions is not normally questioned or litigated. The purpose is to be able to prove that the details of the transaction captured years ago has not be changed or manipulated in the event of some litigation or question. I can provide more details if needed.

1 Answer 1

5

I'd suggest to pay attention to following aspects.

  1. In the described scheme, you cannot prove that the signature was created at that moment that you say. You can modify data that are 10 years old and create a signature with a timestamp of that date. Such signature does not prove that the time stamp is real.

  2. For generated key pair, you should use certificate issued by some CA that you trust. Otherwise, anyone can generate a key pair, modify data and sign them. How will you prove that particular private key is yours or not yours?

  3. To generate a reliable timestamp, use some time stamping authority. It will guarantee that particular content or particular hash (of the content) was really presented at the given time.

  4. If you obtain a certificate, use your private key only once, then delete the private key, it is from the security point of view fine. Since you would generate a new key pair for every new signature, then you would need also a new certificate for every signature. And for the period until you receive certificate, you would need to keep the private key.

5
  • I hadn't considered the time stamping authority, so I appreciate that. I worded the question poorly saying 'point-in-time'. I really only want to ensure that the data is unchanged from the original file. Isn't having the public key proof that the file is unchanged? I don't think it is possible for someone to forge the data to work with the public key I retain. In this process I don't use a certificate but instead just the programmatically generated keys using JS crypto functions.
    – vbuser2004
    Jan 8, 2023 at 4:42
  • @vbuser2004: "Isn't having the public key proof that the file is unchanged?" - yes, but as pointed out in #2 you not only need to prove that the file is signed by a specific public key but also that this public key belongs to you. So either you still have the matching private key to do a real-time proof or the public key was signed by some trusted party which guarantees to others that this public key belongs to you. The latter is point #4, i.e. let some trusted CA give you a new certificate for each new key you need. Jan 8, 2023 at 6:03
  • 1
    @vbuser2004: Why do you need signature at all? If you need a hash only for yourself, then just generate a hash and keep it together with a date. Public key is not needed at all. Public key would be needed only in case you want to sign the data or the hash to show this state to third party. In such case you need a proof that it is your signature and thus you need a certificate. And to confirm to third party that signature was made at particular time, you need a TSA.
    – mentallurg
    Jan 8, 2023 at 7:13
  • 1
    @vbuser2004: Does it play any role who has created the hash? If you only need a confirmation for the hash at particular time, you can just send a hash to the TSA, without your signature. If in the future the attacker modifies the file and claims this was done in the past, then you can present your copy of the file and present a timestamp for the hash issued by TSA. This will prove that your copy of the file corresponds to the sate at the given time.
    – mentallurg
    Jan 8, 2023 at 7:29
  • @mentallurg and Steffen Ullrich - thanks for your comments. This makes a lot more sense to me now. In my new use case it would be pointless not to have a CA and/or TSA. Thanks for your time and added explanation.
    – vbuser2004
    Jan 8, 2023 at 17:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .