2
$\begingroup$

Problem

Given any piece of data, I could sign it with public key and made available online. This proves I am in possession of given data, but it doesn't tell I am the creator. The only possibility (I'm aware of) to prove this, is to prove, that I was chronologically first to have it.

Simple approach.

Lets assume, that I wrote piece of code, and I want to generate some proof, that I am legitimate author of it. I can simply sign it's hash with e.g. RSA and put the signature along source code to some trusted site, like github. Now my commit has timestamp generated with this trusted site, and even if some Alice would sign herself the same source code, her upload to any trusted site will have newer timestamp proving she's not the legitimate author. This works as long as we'd assume data on github has undetermined life span and will be always available which is hardly true about any server out there. When that commit would be lost, my rights to the source code are lost as well: I might still have my local signed copy, but I cannot prove I've created it at given time.

My understanding of the problem.

I believe there is no possibility to self-authenticate, that I were in possession of given data at specific time - I could just made up arbitrary timestamp and sign it. Moreover, anyone out there could get my publicly available data, replace personal data with their, made up older timestamp and call me thief. Thus, sign from trusted server is needed.

Trusted timestamp

My idea of the mechanism is as follow: sign source code, optionally append personal data, generate hash and send this hash to trusted server. Then this server would have to send me back signed information, that it received hash H at time T. This way I've got publicly accepted certificate, that I've got file with hash H at time T. Even if the server had go down, I would still have the certificate.

Question

So is the "trusted timestamp" good solution to the legitimate author problem? Do you know of any available open source tools to achieve this goal? Maybe other techniques? Assuming, I want to public code/publication/anything else licensed for non-commercial use only, should I be concerned with such issues?

$\endgroup$
4
  • 6
    $\begingroup$ Actually, blockchains might be the best answer for this problem; that way, you avoid having to have a "trusted" central authority... $\endgroup$
    – poncho
    Oct 24, 2020 at 3:09
  • 3
    $\begingroup$ Yes trusted timestamping was 'invented' decades ago and there are numerous implementations, both opensource and not. For example, most signed code on Windows (such as drivers) uses this. You do depend on the TSA not being compromised, although you can use multiple TSAs and only need one of them to remain trusted. There are some relevent Qs tagged [timestamp] here and on security.SX. $\endgroup$ Oct 25, 2020 at 0:53
  • $\begingroup$ Thank you for link. This may sound silly, but I've actually made up this term myself and didn't google for it. I've expected some complicated acronym with at least 3 surnames. My apologies for irrelevant question, I've tried to search anything except "timestamp". $\endgroup$
    – Przemek
    Oct 25, 2020 at 2:31
  • $\begingroup$ Update: there is already an answer for my question here: crypto.stackexchange.com/questions/12647/…. @dave_thompson_085 you might consider to repost your comment as an answer so I could accept it. $\endgroup$
    – Przemek
    Oct 25, 2020 at 2:45

0