0
$\begingroup$

I’m looking for suggestions on how best to handle signatures on audit records that might need to be held for many years (at least 5, maybe up to 10). Not in terms of storage - they’ll probably be written to Amazon Glacier or something like that - but in terms of the container format and how to secure the signatures. So far the thoughts are either JSON Web Signatures (JWS) or Cryptographic Message Syntax/PKCS#7 (CMS).

The threat model we’re considering is to be able to verify that the audit record has not been tampered with, assuming an attacker is able to manipulate the stored data.

Obviously signature keys will have been rotated several times during that time frame, and best practice is to erase the private key once the key has expired, but keep the public key for verification.

JWS has the disadvantage that the algorithm is specified in the wrapper and can take the value ‘none’. The usual mitigations for this involve the receiver of the JWS only accepting certain algorithm values, but in the long-term world an algorithm that was used a while ago might no longer be considered acceptable, so a certain amount of meta-data about algorithms and date ranges then becomes necessary. (And this data itself needs to be signed, and updated from time to time.)

Keys can be identified by key label. Even if we prevented the ‘none’ algorithm attack, and had a secure (signed?) set of key identifiers and public key values, if just one key pair had been compromised, an attacker could use that to sign a modified audit record, and specify the label of the compromised key.

So that suggests we need either a CRL- or OCSP-style mechanism for specifying keys that are known to be compromised. And since that list itself needs to be signed, it probably needs to be live/online, rather than something also kept in the archive.

I don’t know CMS very well at all. Does it provide any capabilities that make it better than JWS for this this?

Are there any (other?) standards for this kind of thing that I should be looking at? Would a (not "the") blockchain be a better structure for this (providing historical immutability)?

Is there something that I’m missing? Am I over-thinking this?

Improve this question
$\endgroup$
2
  • 2
    $\begingroup$ Have you looked into "long term archiving and notary services"? I think tools.ietf.org/html/rfc4810 is the initial RFC. There are multiple standards available like LTANS. However, I don't know if there is anything production ready. $\endgroup$
    – grees
    Jul 8, 2019 at 7:53
  • 1
    $\begingroup$ To me JWS has always felt as a rather simplistic standard. It feels like somebody saw a need, and directly used cryptography to fill that need, rather than creating a holistic standard that provides indications on how to manage keys as well. In that sense CMS / X.509 is much more involved and does provide many more hooks for key management. But yeah, you'd still have to create the key management yourself, it is not a standard for that after all. And no, this is not over-thinking it, most organizations are under-thinking this. $\endgroup$
    – Maarten Bodewes ♦
    Jul 8, 2019 at 7:58

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.