I’m looking for suggestions on how best to handle signatures on audit records that might need to be held for many years (at least 5, maybe up to 10). Not in terms of storage - they’ll probably be written to Amazon Glacier or something like that - but in terms of the container format and how to secure the signatures. So far the thoughts are either JSON Web Signatures (JWS) or Cryptographic Message Syntax/PKCS#7 (CMS).
The threat model we’re considering is to be able to verify that the audit record has not been tampered with, assuming an attacker is able to manipulate the stored data.
Obviously signature keys will have been rotated several times during that time frame, and best practice is to erase the private key once the key has expired, but keep the public key for verification.
JWS has the disadvantage that the algorithm is specified in the wrapper and can take the value ‘none’. The usual mitigations for this involve the receiver of the JWS only accepting certain algorithm values, but in the long-term world an algorithm that was used a while ago might no longer be considered acceptable, so a certain amount of meta-data about algorithms and date ranges then becomes necessary. (And this data itself needs to be signed, and updated from time to time.)
Keys can be identified by key label. Even if we prevented the ‘none’ algorithm attack, and had a secure (signed?) set of key identifiers and public key values, if just one key pair had been compromised, an attacker could use that to sign a modified audit record, and specify the label of the compromised key.
So that suggests we need either a CRL- or OCSP-style mechanism for specifying keys that are known to be compromised. And since that list itself needs to be signed, it probably needs to be live/online, rather than something also kept in the archive.
I don’t know CMS very well at all. Does it provide any capabilities that make it better than JWS for this this?
Are there any (other?) standards for this kind of thing that I should be looking at? Would a (not "the") blockchain be a better structure for this (providing historical immutability)?
Is there something that I’m missing? Am I over-thinking this?