Signature and Timestamp for Long Term Document Archival Question

Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.

As far as I understand, I need to timestamp the signature in order to ensure it remains valid even after certificate expiration.

Let's say I use a trustworthy TSA. From what I understand they sign the timestamp with they own signature.

Now, let's suppose the original TSA bankrupts or is compromised and its certificates revoked. Will my document remain readable without warnings?

Answer 1

Time stamps are also signatures; see for instance RFC 3161 which is the most commonly used time stamp format. In particular, such time stamps also rely on certificates (the TSA certificate), and thus also expire.

So you need regular time stamping; whenever the latest time stamp is about to expire (but before expiration), you need to obtain a new time stamp computed over the previous time stamp. Such chaining is described in several standards, including PAdES (which supports embedding signatures and time stamps within the PDF file itself); a somewhat clearer description of time stamp chaining is Evidence Record Syntax.

To survive unexpected loss of a TSA before the time stamp expiration date (e.g. due to a compromise), you can use several TSA and interleave them in the chain: you get a time stamp from TSA A, and immediately after another time stamp from TSA B (computer over the time stamp from A). Whenever either time stamp is about to expire, expand the chain with two extra time stamps, again from A then from B. With interleaving, you can survive the loss of either TSA (but, of course, not of both).

Answer 2

It would seem that the answer is no. If the TSA's private key is compromised (and thus revoked), the time stamp signature cannot be trusted as whoever compromised it could sign documents with old time stamps. Surely users would want to be warned before accepting a time stamp signature from a compromised certificate.

It seems then if this is your threat model, you have the following (and maybe more) options:

1. Get a signed time stamp from multiple TSAs. If any one is not revoked, that signature can still be trusted.

2. Use threshold signing, so that an attacker would have to compromise a number of parties in order to forge signatures (which is much less likely than compromise of a single party).

Answer 3

Time stamps, just like regular signatures, are valid only as long as the certificate connected to them is valid.

In other words, time stamp becomes useless in the same moment as the TSA ceases operation, is compromised, etc.

The solution to this problem, is to get few time stamps on one file and regularly time stamp it before any of the TSA certificates is about to expire. The cryptographic format governing this for PDF files is PAdES-A.

Answer 4

I would encourage to take a look and different Cryptographic Timestamping methods.

My favourite schemes are: distributed, Linking-based and hybrid schemes like Linked and signed.

The last one Linked and signed especially in distributed model seems very strong and does not relay on PKI (when signing fails, there is always linked scheme behind).

Let's take this, as example scheme: http://www.guardtime.com/signatures/technology-overview/ (please click on each section to roll-out it and read contents). It uses distributed hash-tree structures, periodically collects in calendar database and print top-tree hash in Markets section of Financial Times.