14

Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy?

There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be assured the contents are secure, that access is constrained and under strict and constant surveillance, and that no one other than yourself and certain named and properly authenticated others will ever have access. It's the traditional place to safekeep things like one's last will and testament, property deeds, family jewels, the map to great grandpap's treasure box under the ol' crooked oak tree, and so on.

Is there a digital analogue? A place to keep one's master password file and other digital treasures safe and secure, but available to authorized people upon one's death or other defined circumstances?

update, 2011-Jun-13 - Here's the central idea presented as a story, provided by this.josh:

Alice has some data protected with access controls to maintain the data's confidentiality. Alice has a friend (or family member) Bob. In the event of Alice's death, she wants to pass ownership of the data to Bob. If Alice had stored the data on a DVD and kept it in a safe deposit box, and had written a will specifying that she wanted Bob to receive the DVD after her death. All Bob would need to get access to the DVD would be a copy of the will and a death certificate. Something that works like this, but digital.

Improve this question
8
  • 1
    I selected the tag authentication because I had choose at least one. Please feel free to delete/retag as appropriate.
    – matt wilkie
    Jun 8, 2011 at 16:51
  • Are you thinking of something like a GPG encrypted file on your own computer? Or more like tarsnap, for secure backups?
    – user502
    Jun 8, 2011 at 18:19
  • 3
    I think it might help to flush out the safe deposit box metaphore. My safe deposit box is not as available as I would like; the bank keeps certain limited hours. I need to wait in line for a teller to let me into the vault (aka safe). It provides good integrity. The contents of my box are protected against a lot of potential threats: fire, flood, etc. The confidentiality is pretty good. I am required to present a government issued photo ID, handwriten signature, and box key. What threats are you looking to protect your digital data from?
    – this.josh
    Jun 8, 2011 at 22:13
  • 2
    Ok, I think this is what you mean. Alice has some data protected with access controls to maintain the data's confidentiality. Alice has a friend (or family member) Bob. In the event of Alice's death, she wants to pass ownership of the data to Bob. If Alice had stored the data on a DVD and kept it in a safe deposit box, and had written a will specifying that she wanted Bob to receive the DVD after her death. All Bob would need to get access to the DVD would be a copy of the will and a death certificate. You want something that works like that but digital.
    – this.josh
    Jun 9, 2011 at 22:56
  • 1
    @matt wilkie, i think the most simple solution to this, is to put the master password or decryption key into the will.
    – Hendrik Brummermann
    Jun 12, 2011 at 9:52

5 Answers 5

Reset to default
11

There are three meanings for "safety" here:

  1. safe against eavesdroppers (confidentiality);
  2. safe against malicious alterations and/or theft (integrity & availability);
  3. safe against accidental alteration and/or loss (integrity & availability, also).

Amazon S3 is a service which strives at providing safety types 2 and 3, but not 1. However, their liability in case of alteration or loss seems to be limited.

There exist solutions for higher security (at least for protection against loss), but they are not cheap. They involve storage duplicated into several data centers which are physically remote from each other (as was said in the aftermath of the World Trade Center destruction in 2001, "a local in the basement" is not remote enough, even in a 400m high building). One example of a society which offers that kind of "secure archival" is Zantaz.

Provable long term integrity (i.e. not only the files are not altered, but it can be proven in a way which could convince a judge during a dispute) requires Time Stamps, and (for the "long term" part) more time stamps in successive layers (e.g. as specified in ERS).

Confidentiality is mostly orthogonal to all of that. You get it through encryption, which reduces the problem (you no longer have to worry about 400 GB of data, but only a 128-bit symmetric key or an equivalent such as a "long" passphrase). You should be able to remember a single passphrase; for added safety, print it and store the paper in a bank (in case you forget it, or your heirs must get it after your demise).

Improve this answer
3
  • 2
    The tough part, from the augmented question, is enforcement of rules like "People named in the will can get at it but only after the death of the owner".
    – nealmcb
    Jun 11, 2011 at 23:38
  • Integrity is also important as a way of preserving the non-refutability of any rights encapsulated in data stored therein such as the authenticity of another digital will stored in the dropbox.
    – Mike Samuel
    May 1, 2012 at 23:30
  • @nealmcb, if the proof of the ability to access the will is a large random string, then part of that that string can serve as proof of ownership via signature verification, and the rest can serve as preservation of confidentiality via encryption. You present part of your key, and you get the data which you can then decrypt with the rest of your key, and maybe even use a third part to check the signature of the decrypted content to make sure it was not tampered with. Obviously, the part that establishes authority could be a swiss-number so the content need not be stored at a guessable URL.
    – Mike Samuel
    May 1, 2012 at 23:32
9

This may sound very non-technical, but the simple way to do this is:

Start as per @ThomasPornin's answer -

  • use strong encryption on your data for confidentiality, and use a very long passphrase (sufficent to rule out brute forcing in any reasonable timeframe)
  • store the encrypted data in various locations for availability (personally I wouldn't want to trust any 'cloud' service for availability...)

But then go low tech - store the passphrase in an envelope, in that safe deposit box - just the same as you would with documents.

Simple process; tried and tested, and the controls are well understood.

Improve this answer
1

You could encrypt the file in several layers, each using a different key. Then give those keys to a number of trusted people, some who have an interest in the data, some who are neutral, such as the lawyer who deals with the will.

Each person involved would also have a copy of the file once it was fully encrypted, so the odds of all of them losing the file are reduced. They can store the file wherever they like, on their computers or in the cloud or wherever they like.

Now for the data to be revealed ahead of time all the people with keys would have to collude, which, if some are not interested parties is unlikely.

You could vary this scheme in other ways, such as giving the key to each layer to more than one person, so should one of those people die before your will can be acted on there's still someone who can get through each layer. This would make it easier to collude of course, but would make the scheme more reliable.

Which you choose would depend on what was the worse outcome - having the data released too soon, or not having it released at all.

Of course, now you're somewhat of the mercy of the security skills of those other people, which may be undesirable, in which case you might want to get them to stick their key in their deposit box.

Improve this answer
10
  • I'm not sure this really hits the nail on the head - there's other ways to address the safety deposit box issue. When you wrap the same data in layers of encryption, one atop the other, you can both introduce weaknessness in the cryptotext, and end up with a situation where all keys (and keyholders) need to be around to decrypt the data. The essence of both a real-world safety deposit box, and a digital implementation is that there is a trusted 3rd party with an extra set of keys.
    – bethlakshmi
    Sep 14, 2012 at 20:42
  • I thought I'd addressed the issue of all the keyholders being needed by suggesting that each key could be known to more than one person. Could you elaborate on the risks of encrypting something which is already encrypted. I understand you'd need entirely unrelated keys, but I don't see what the risk is so long as that is the case. Notably Truecrypt allows you to encrypt using multiple algorithms with independent keys - although I presume that is to protect against defects being found in an algorithm in the future. What have I missed? I assumed than none of the parties can be entirely trusted.
    – Peter Bagnall
    Sep 14, 2012 at 20:51
  • The example in question suggests that Bob can only get to Alice's data after her death... giving the key to the collection of people works quite differently - anyone can get access to the data at any time.
    – bethlakshmi
    Sep 14, 2012 at 20:55
  • No, I think you misunderstood, I wasn't suggesting you give the only key to many people. I was suggesting that you encrypt in (say) three layers, and then give each key to (say) two people. So if one of the keyholders dies before Alice, you have a backup for that layer. But because there are two other layers the data is still safe. Perhaps I should redraft to make that clearer.
    – Peter Bagnall
    Sep 14, 2012 at 20:58
  • 1
    It's not true for every algorithm or every combination, but 2DES is the classic example - running DES twice with 2 keys does not increase the security over DES as there is a meet-in-the-middle attack for it.
    – bethlakshmi
    Sep 14, 2012 at 20:58
1

What about something like this?

Alice stores the data in (device) with a strong encryption, say RSA with keylength of 4096 bits.
Once a (period, say 1 month), she logs into her (device).
Alice (put issue here), so she doesn't log in for (period).
The (device) releases the key.

Yet there's a problem because you need to store the key somewhere, but that's a start point.

Improve this answer
0

Verisign / Symantec offers a service like this at https://pip.verisignlabs.com/ They encourage you to upload sensitive documents into their digital locker for safekeeping.

Symantec and Verisign is a trusted brand, however the "labs" naming makes me wonder how permanent the service offering will be.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .