1
$\begingroup$

How could a site issue a `warrant'*, a document which: 1) Others can verify was issued from that site 2) Contains a date stamp, a named site and instructions which can be presented to a third site by the named site as authority to carry out an action.

Of course, the problem is to make this secure, and I was hoping that someone could tell me where to look to find out how to do this. I suspect that this is very well known, so just a reference would do.

To explain more, I need to say why the name `warrant' was used. The idea is that a court can issue a warrant, and that a police officer can then take the warrant and police ID to a third party to obtain whatever (information..). The motivation is to increase privacy by requiring explicit and traceable authorisation for information collection, so the need for secure communication and identification is paramount. E.g., consider a monitoring system attached to a camera. The camera could be programmed to require authorisation from a higher entity in order to release data to the monitoring system, so the system has to give the camera a warrant. The procedure should be resistant to someone hacking into the monitoring system without the required authorisation...

Thanks and apologies for the low standards from a beginner here!

$\endgroup$
1
$\begingroup$

Your warrant just needs a simple digital signature, which provides the properties of authenticity and non-repudiation. That is very basic. Of course you need a proper public key infrastructure (PKI) along that, to ensure that everyone actually knows which verification keys are real, etc.

Regarding your different authorization levels, you might want to look into Mandatory Access Control, which then needs to be fulfilled by the PKI. But instead of granting access, you use it to decide which certificates are signed within the hierarchy. I guess you are looking for a compliance solution here, not a fancy technical solution, which might not have a mature implementation.

In general, this question is actually not about cryptography (at most about the application of cryptographic standards) and might be better suited for security-SE.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.