Is it possible to create a "digital seal" to tell if a document has been opened?

Question

So, in real life we have a handful of ways to leave a physical mark on a packet to know if it has been opened without authorization (eg. you can use 'opened' security tapes, or you can put a signature or stamp right through the envelop opening). One thing i see these tells share, is that they are some sort of signature that self destructs on any attempt to open the package.

My question is if you can build a digital equivalent to these seals. I'm aware encrypting the packet is a way to ensure its confidentiality, but it requires the eventual recipient to know a secret to decrypt it. One scenario where I don't see this working is sealed wills/testaments (which should only be opened and read once the testator has actually died), in this case when the custodian of the will first receives it, the eventual recipients are still unknown (the testator could die many years in the future, by then many of the intended recipients could be gone too).

My first thoughts are, probably it's impossible, as it's always easy to make a bitwise copy of the "sealed" document, open it, and then deliver the unmodified one with its intact signature, but i wanted to know if someone with more experience in cryptography could come with a solution.

Answer 1

Encrypt your document, and embed a web address (and login details) in the packaging from which a reader can get the decryption key. The website must be trusted. The website logs will tell you when software has requested the key to decrypt it.

If you also want to protect confidentiality, encrypt with two keys. One is the usual private key used to protect confidentiality, that the recipient has been given securely, the other is the tamper seal that has to be obtained from the website.

Answer 2

With classical information, there is no way as you correctly surmise: someone could always duplicate the data. However with quantum information there is a no-cloning theorem. With quantum information it is possible to bound the amount of information that has been extracted from a system based on the fidelity of the system. This gives the concept of tamper evident transmission that is the underlying principle that allows quantum key distribution.

One could apply the same concept to "files" or "documents" of quantum information, but the lack of long term quantum memory with current technology mean that this is not yet viable.

Answer 3

Not with a file, as you say in your question

You can always take a bitwise copy of a file. Always. Even if some specific OS makes it inconvenient, you can change to an OS which does let you.

This leaves you with two possibilities for confirming opening.

The file is encrypted in some way which requires you to access an external website to get the key, and that external website tracks key requests

If you encrypt a file using current-best techniques, with a ridiculously high length key, it is practically impossible for anyone (even nation-states) to decrypt. (At least until quantum computers break all crypto, but let's not go too sci-fi, right?) Send the file (or its hash) to the external website, you get back the key, and the external website counts up the decrypt requests.

This has two obvious problems - it assumes the internet connection is infallible, and that computer software never crashes. If the reply with the key never gets to you, or if the program doing the requesting crashes at the wrong time, the site will report that the file has already been read but in fact you haven't read it. This might be considered a fail-safe approach, of course, but if you are only allowed one opportunity to read the document then you're stuck.

The file lives on external hardware

If you're in control of physical hardware, you can control what it does. It might look like a normal memory stick, but it's perfectly possible for the onboard controller to track accesses. Reading a file would simply run a counter for that file.

The problem here is that many OSes will automatically read the file to show you a thumbnail. They may even take a mirror copy of the file in the background so that they can show it to you faster, which for a regular file would be a good thing but isn't what you want here. So again it's possible that the file could be reported as read when it isn't.

This at least has a solution. Instead of looking like a normal file system, the "memory stick" could actually be some completely different system which works with an application. The application is then in full control of reading the file.

There's still no solution to inconveniently-timed application crashes though.

Answer 4

Slightly tongue-in-cheek answer, but why not put the document on a usb key, then put the usb key in a box and wrap it with the tamper evident physical seals you pictured. That way the document is secure (inside the box) and people will know if anyone has attempted to read the data (because of the physical seals you have to break to get at the usb key).

Answer 5

I'll choose a more generic approach which can be applied even to non-digital. Minor note, I can re-tape the package from your photo or reproduce my copy of the seal. It's a matter of how well made it has to be to fool you.

The premise here is to have a way to do something (digitally) and preserve a state of it. However, for that to not be tampered with you need at least one or these things:

1. restricted access for the recipient who opens i.e. not to have root or physically access the medium i.e. protection

   otherwise I can do whatever I want with the content and modify it however I like limited only by resources (or time)

2. asking for the (or a part of) content through an untamperable medium for the recipient i.e. pulling from a medium you control or have wider access over than the recipient

   which allows you to track the "asks" and assume opening (without proof)

3. active communication between the recipient and you

   so you get either a half-yes (you don't know when, but the recipient has the means to read - eventually) by the recipient knowing the content and telling you by a mistake, or fully valid and verifiable yes (proof of reading e.g. recipient's conscious action recorded somewhere or by someone).

Now for the implementation you need to pick at least one for start e.g.:

• protection

  • the content reader is known, but with limited access allowed, therefore you'll know when it's used and therfore content read (think Rosetta stone or other unique thing)
  • the content can't be moved out of the storage medium, therefore the recipient has to use only provided set of methods (chained, locked, guarded)

• pulling

  • asking for the content (key to the lock)
  • asking for the content reader (again, Rosetta or a dictionary)
  • both

• communication

  • telling you via a known channel to you e.g. modified reader that sends an HTTP request (beware firewalls and network limitations/cut offs/encapsulation) or simply an email/letter/signature
  • the medium is aware of access operation and will tell you, somehow (filesystem watch, OS hook for a syscall, wax seal, etc) either remotely or by you having an access to it eventually after reading operation

Combinations are a way more powerful and it's basically a wet dream of a company with a paid, restricted/limited digital product to have it always and properly working:

• I have a medium (e.g. server) that has content/reader/both - but you may have downloaded/copied/pirated/received it
• I have a limited amount of readers / keys, so I can match it to you (serial keys for games), but you can just have one from a friendly alternate source
• the medium listens for phoning home by the reader (license/serial verification) before providing the content, but I can force it so it doesn't (disconnect network, VM, mock/proxy, alias in /etc/hosts, destroy after reading)
• I'll provide you environment and medium controlled by me, reader and content, but you may have still obtained it from a friend who accessed it before you (DRM basically and why it's practically useless because we're operating across time and with copies of the content)

So there are two big issues to solve and neither is technical:

• how to prevent the content to be received via a different medium (which you don't control)
  • you have to make it readable only once, on a medium and reader you control, in an environment the recipient can't leverage third party methods of replicating the content (photo, pen&paper, human memory)
• how to prevent the communication halt
  • monitoring or such limited environment, medium, reader and content while preventing a malicious action and a safety net of a possible mental/physical force to enable the communication (law, threats, spying, torture, etc)

In general you're looking for a mind control because each and every method has its loopholes that can be leveraged and you as the keeper/creator of the content have to decide which risks you're willing to accept and what percentage of failure rate you're willing to accept according to the targeted set of recipients and their skills/predispositions/means for not wanting to comply.

Answer 6

Give each stakeholder a part of the secret key so that no subset of all intereested parties can decrypt the message. They all have to cooperate and share their parts in order to decrypt and they all have control over when they release their part to the others.

Answer 7

More incentive-based than crypto-based (anyway proposing it just because it means you are using someone else crypto ;-) ):

append to the text going to be encrypted a reward, for example the privkey of a rich-enough Bitcoin UTXO, then monitor that UTXO.

Of course to be effective you have to correctly value (from attacker POV) the "secret decryption" event, and put in the UTXO an higher BTC equivalent (applying some correction factor to take into account expected BTC volatility - no volatility problem if you use any stablecoin).

Of course the reward-way doesn't need to deal with a cryptocurrency, but that makes checks easier

Answer 8

This is the kind of thing that is considered theoretically impossible for decades and then someone invents asymmetric cryptography or Bitcoin.

As a starting point, consider encrypting each copy of a document with a different key, and storing the hash of the ciphertext in a public ledger along with an "opened" flag. This flag would be set during a transaction where someone requests the key to decrypt a document. (Transactions which unset the "opened" flag would be invalid.)

I can't see a way where this doesn't require a trusted party to hold the key, and only give it out during a valid transaction, but conceivably with some clever tricks involving things like homomorphic encryption, zero-knowledge proofs and secret sharing it should be possible to limit the trust placed in any one entity.

Answer 9

This is quite possible in most context. You have reprogrammable memory, and so we see existing technology can easily store a value and control how that value is to be used.

Software or hardware both can independently accomplish this.

Asking if these concepts can be bypassed is simply too broad of a question. There simply is no general principle which describes such a thing. Hardware or software implementation is what distinguishes the answer here, and how such a thing would work. It has nearly nothing to do with a central concept of tamper proof information, and everything to do with the implementation.

I know this isn't what you want to hear, but come on folks you got to get serious. Put the work in.

One thing that helps in actually getting an answer is to clearly define the question. Like what does tampering mean, on a critical thinking level. Maybe we can have a spatial coordinate and time, a boundary, and integer represented in some finitely definable way, contained in a bounded volume. The question then, is there a way to detect if that integer exists elsewhere as an effect of the original, or as a consequence. Was their a physical process that led to some other definable representation of that integer.

But now the question is getting closer to being a solvable question, with a clear, correct discernable answer.

Answer 10

Version control is really the only solution to this as the document would need to be managed.

I would have to say version control over a document is really the only real way to track changes to a file and be able to work off one instance of the document. The reason this is the case is that you need to track state of a document not content. Anything outside of a document management/ version control environment can loose the tracking metadata and be copied over and over. There are caveats to this of course - you will only be able to track the changes in the environment you are in.

For example, You can track the state of documents in Adobe Sign when the are opened by the signer, and also track the changes when they signed the document - this then seals the pdf with a certificate to disable editing.

Another example of change tracking would be the change the tracking details panel in SharePoint. It shows a timeline of all events.

Answer 11

I know the Word documents, Excel spreadsheets, and PDF files have mechanisms from executing some code when opened. You could create a routine that calls a URL when opened, and that URL would just be a tracker that logs the number of times the document is opened.

There are vulnerabilities. The document needs to have web access when opened. You could have the routine delete all contents if it failed to contact the website.

A determined party could determine the route of the URL, open the document in an isolated network and intercept the URL call to preclude the shell. Or programmatically alter the binary to disable your routine before opening.

This would be a way to keep honest people honest.

Answer 12

A digital storage device that includes a serial number and 'read' counter.

Create your document. Store it on the device. Note the SN and read count.

If the next person reads the document and the read count is not prior + 1, then they know that it has been viewed.