40
$\begingroup$

So, in real life we have a handful of ways to leave a physical mark on a packet to know if it has been opened without authorization (eg. you can use 'opened' security tapes, or you can put a signature or stamp right through the envelop opening). One thing i see these tells share, is that they are some sort of signature that self destructs on any attempt to open the package.

Security tape

My question is if you can build a digital equivalent to these seals. I'm aware encrypting the packet is a way to ensure its confidentiality, but it requires the eventual recipient to know a secret to decrypt it. One scenario where I don't see this working is sealed wills/testaments (which should only be opened and read once the testator has actually died), in this case when the custodian of the will first receives it, the eventual recipients are still unknown (the testator could die many years in the future, by then many of the intended recipients could be gone too).

My first thoughts are, probably it's impossible, as it's always easy to make a bitwise copy of the "sealed" document, open it, and then deliver the unmodified one with its intact signature, but i wanted to know if someone with more experience in cryptography could come with a solution.

$\endgroup$
8
  • $\begingroup$ A digital case with temper proof? Also, there are paper PUFs that the document can't be replicated. Your question is not clear to me. What is mean to be opened? One can x-ray and reveal the internals, or more techniques. Do you want to protect the data or the envelope that contains the paper, or both? $\endgroup$ – kelalaka Mar 13 at 15:19
  • 7
    $\begingroup$ Is there any way to track if a ciphertext has been decypted? $\endgroup$ – kelalaka Mar 13 at 15:50
  • 1
    $\begingroup$ I would like to mention that, in modern cryptography, we consider that even the adversary has access to knowledge of the used encryption scheme, the ciphertext, and IV, it should be secure against computationally bounded adversaries. While an unknown dated QC circuit can be a solution to your problem with a huge cost, the copy is the least issue one must consider. The package lost, lack of integrity, authentication, disturb of the channel, active attacker and so on the list goes on. Also not that the physical protections are mostly protection from the cats and dogs. Do you know NSA-DHL-laptop? $\endgroup$ – kelalaka Mar 13 at 17:59
  • 4
    $\begingroup$ "easy to makwe a copy" yes that it the problem digital documents are not transported, they are copied. $\endgroup$ – Jasen Mar 14 at 9:53
  • 2
    $\begingroup$ From information security: Schemes/ Mechanisms that could provide one time decryption? $\endgroup$ – kelalaka Mar 15 at 13:42

12 Answers 12

58
$\begingroup$

Encrypt your document, and embed a web address (and login details) in the packaging from which a reader can get the decryption key. The website must be trusted. The website logs will tell you when software has requested the key to decrypt it.

If you also want to protect confidentiality, encrypt with two keys. One is the usual private key used to protect confidentiality, that the recipient has been given securely, the other is the tamper seal that has to be obtained from the website.

$\endgroup$
11
  • 4
    $\begingroup$ So, three-word agencies can capture the packaging, read the contents, access the web site from a backdoor that leaves no trace, done! $\endgroup$ – kelalaka Mar 13 at 22:52
  • 12
    $\begingroup$ The protocol only detects opening, it doesn't purport to protect confidentiality against government agencies. (If you want to do that, encrypt with tamper seal key, append login details, then encrypt the whole lot with one time pad. You need the OTP key to do anything with it, and then you need the tamper seal key to read the document itself.) The government accessing the website as you suggest would detect their tamper, as required. If the government really wanted to fake it, they'd court-order or MIB the website operators. $\endgroup$ – Nullius in Verba Mar 13 at 23:08
  • 8
    $\begingroup$ Is this effectively equivalent to just storing the document on the website? $\endgroup$ – Barmar Mar 13 at 23:08
  • 27
    $\begingroup$ Just storing the document on the website would also achieve the required effect, but with much higher storage and bandwidth requirements, and would mean the website has to be trusted with the document itself, not just the key. $\endgroup$ – Nullius in Verba Mar 13 at 23:12
  • 4
    $\begingroup$ The problem can certainly be solved with a trusted escrow agent, but is this really the analogy to the tamper evident seal? It feels more like the equivalent of locking the will/document in a safe deposit box and giving the key to lawyers. $\endgroup$ – Daniel Shiu Mar 14 at 0:29
22
$\begingroup$

With classical information, there is no way as you correctly surmise: someone could always duplicate the data. However with quantum information there is a no-cloning theorem. With quantum information it is possible to bound the amount of information that has been extracted from a system based on the fidelity of the system. This gives the concept of tamper evident transmission that is the underlying principle that allows quantum key distribution.

One could apply the same concept to "files" or "documents" of quantum information, but the lack of long term quantum memory with current technology mean that this is not yet viable.

$\endgroup$
1
  • 5
    $\begingroup$ Right. So with current technology, you can use a handshake protocol involving a laser beam (or optic fibre) of randomly polarised photons to generate an encryption key that would be scrambled if someone in the middle tried to eavesdrop on the beam. If the recipient gets the key directly from the beam and it works, they know for sure that they're the first person to get it. $\endgroup$ – Robyn Mar 14 at 23:56
13
$\begingroup$

Not with a file, as you say in your question

You can always take a bitwise copy of a file. Always. Even if some specific OS makes it inconvenient, you can change to an OS which does let you.

This leaves you with two possibilities for confirming opening.

The file is encrypted in some way which requires you to access an external website to get the key, and that external website tracks key requests

If you encrypt a file using current-best techniques, with a ridiculously high length key, it is practically impossible for anyone (even nation-states) to decrypt. (At least until quantum computers break all crypto, but let's not go too sci-fi, right?) Send the file (or its hash) to the external website, you get back the key, and the external website counts up the decrypt requests.

This has two obvious problems - it assumes the internet connection is infallible, and that computer software never crashes. If the reply with the key never gets to you, or if the program doing the requesting crashes at the wrong time, the site will report that the file has already been read but in fact you haven't read it. This might be considered a fail-safe approach, of course, but if you are only allowed one opportunity to read the document then you're stuck.

The file lives on external hardware

If you're in control of physical hardware, you can control what it does. It might look like a normal memory stick, but it's perfectly possible for the onboard controller to track accesses. Reading a file would simply run a counter for that file.

The problem here is that many OSes will automatically read the file to show you a thumbnail. They may even take a mirror copy of the file in the background so that they can show it to you faster, which for a regular file would be a good thing but isn't what you want here. So again it's possible that the file could be reported as read when it isn't.

This at least has a solution. Instead of looking like a normal file system, the "memory stick" could actually be some completely different system which works with an application. The application is then in full control of reading the file.

There's still no solution to inconveniently-timed application crashes though.

$\endgroup$
3
  • 3
    $\begingroup$ You could also simply package the memory stick inside tamper evident hardware, or manufacture it physically sealed shut, so that it would have to be broken open to connect to a computer. Of course then you couldn't have multiple documents on the stick and track which were accessed and which weren't. $\endgroup$ – bdsl Mar 15 at 8:45
  • $\begingroup$ Quantum computers don’t break all crypto. $\endgroup$ – user76284 Mar 16 at 1:56
  • $\begingroup$ @usee76284 Like I said, not going sci-fi. :) $\endgroup$ – Graham Mar 16 at 8:51
6
$\begingroup$

Slightly tongue-in-cheek answer, but why not put the document on a usb key, then put the usb key in a box and wrap it with the tamper evident physical seals you pictured. That way the document is secure (inside the box) and people will know if anyone has attempted to read the data (because of the physical seals you have to break to get at the usb key).

$\endgroup$
4
  • 3
    $\begingroup$ Slightly tongue-in-cheek comment: I will open the box with the seals, read the usb key, then close the usb key in an exactly equal and new tamper-proof box with exactly the same seal. $\endgroup$ – EarlGrey Mar 15 at 14:12
  • 2
    $\begingroup$ @EarlGrey, You're saying the tape has no value, but the people who make and sell it for profit know better. It comes down to how much one entity will spend to secure something, and how much some other will spend to defeat that security. That tape isn't highly secure, but it's cheap, and there is a class of snooper who will be deterred by it---Should the US military rely on that tape to know when it's time to change the nuclear codes? probably not. Should a business use it to discourage a courier from opening letters just on the off chance that they might find something good? Maybe so. $\endgroup$ – Solomon Slow Mar 16 at 1:27
  • $\begingroup$ Good security tape has anti-forgery features. You choose how much your physical security is worth. With USB devices, you might be able to simply tape over the connector, or (better) tape the cap to the body. But make sure an attacker can't slide wires past the tape to make contact. $\endgroup$ – Toby Speight Mar 16 at 7:40
  • $\begingroup$ You could also use a Pelican with nail polish, but that relies on having a safe external route to send the original pictures. $\endgroup$ – IronEagle Mar 16 at 15:38
4
$\begingroup$

I'll choose a more generic approach which can be applied even to non-digital. Minor note, I can re-tape the package from your photo or reproduce my copy of the seal. It's a matter of how well made it has to be to fool you.

The premise here is to have a way to do something (digitally) and preserve a state of it. However, for that to not be tampered with you need at least one or these things:

  1. restricted access for the recipient who opens i.e. not to have root or physically access the medium i.e. protection

    otherwise I can do whatever I want with the content and modify it however I like limited only by resources (or time)

  2. asking for the (or a part of) content through an untamperable medium for the recipient i.e. pulling from a medium you control or have wider access over than the recipient

    which allows you to track the "asks" and assume opening (without proof)

  3. active communication between the recipient and you

    so you get either a half-yes (you don't know when, but the recipient has the means to read - eventually) by the recipient knowing the content and telling you by a mistake, or fully valid and verifiable yes (proof of reading e.g. recipient's conscious action recorded somewhere or by someone).

Now for the implementation you need to pick at least one for start e.g.:

  • protection

    • the content reader is known, but with limited access allowed, therefore you'll know when it's used and therfore content read (think Rosetta stone or other unique thing)
    • the content can't be moved out of the storage medium, therefore the recipient has to use only provided set of methods (chained, locked, guarded)
  • pulling

    • asking for the content (key to the lock)
    • asking for the content reader (again, Rosetta or a dictionary)
    • both
  • communication

    • telling you via a known channel to you e.g. modified reader that sends an HTTP request (beware firewalls and network limitations/cut offs/encapsulation) or simply an email/letter/signature
    • the medium is aware of access operation and will tell you, somehow (filesystem watch, OS hook for a syscall, wax seal, etc) either remotely or by you having an access to it eventually after reading operation

Combinations are a way more powerful and it's basically a wet dream of a company with a paid, restricted/limited digital product to have it always and properly working:

  • I have a medium (e.g. server) that has content/reader/both - but you may have downloaded/copied/pirated/received it
  • I have a limited amount of readers / keys, so I can match it to you (serial keys for games), but you can just have one from a friendly alternate source
  • the medium listens for phoning home by the reader (license/serial verification) before providing the content, but I can force it so it doesn't (disconnect network, VM, mock/proxy, alias in /etc/hosts, destroy after reading)
  • I'll provide you environment and medium controlled by me, reader and content, but you may have still obtained it from a friend who accessed it before you (DRM basically and why it's practically useless because we're operating across time and with copies of the content)

So there are two big issues to solve and neither is technical:

  • how to prevent the content to be received via a different medium (which you don't control)
    • you have to make it readable only once, on a medium and reader you control, in an environment the recipient can't leverage third party methods of replicating the content (photo, pen&paper, human memory)
  • how to prevent the communication halt
    • monitoring or such limited environment, medium, reader and content while preventing a malicious action and a safety net of a possible mental/physical force to enable the communication (law, threats, spying, torture, etc)

In general you're looking for a mind control because each and every method has its loopholes that can be leveraged and you as the keeper/creator of the content have to decide which risks you're willing to accept and what percentage of failure rate you're willing to accept according to the targeted set of recipients and their skills/predispositions/means for not wanting to comply.

$\endgroup$
2
$\begingroup$

Give each stakeholder a part of the secret key so that no subset of all intereested parties can decrypt the message. They all have to cooperate and share their parts in order to decrypt and they all have control over when they release their part to the others.

$\endgroup$
1
$\begingroup$

More incentive-based than crypto-based (anyway proposing it just because it means you are using someone else crypto ;-) ):

append to the text going to be encrypted a reward, for example the privkey of a rich-enough Bitcoin UTXO, then monitor that UTXO.

Of course to be effective you have to correctly value (from attacker POV) the "secret decryption" event, and put in the UTXO an higher BTC equivalent (applying some correction factor to take into account expected BTC volatility - no volatility problem if you use any stablecoin).

Of course the reward-way doesn't need to deal with a cryptocurrency, but that makes checks easier

$\endgroup$
0
$\begingroup$

This is the kind of thing that is considered theoretically impossible for decades and then someone invents asymmetric cryptography or Bitcoin.

As a starting point, consider encrypting each copy of a document with a different key, and storing the hash of the ciphertext in a public ledger along with an "opened" flag. This flag would be set during a transaction where someone requests the key to decrypt a document. (Transactions which unset the "opened" flag would be invalid.)

I can't see a way where this doesn't require a trusted party to hold the key, and only give it out during a valid transaction, but conceivably with some clever tricks involving things like homomorphic encryption, zero-knowledge proofs and secret sharing it should be possible to limit the trust placed in any one entity.

$\endgroup$
4
  • 6
    $\begingroup$ I think this answer basically says, "because bitcoin". $\endgroup$ – marshal craft Mar 15 at 3:23
  • 6
    $\begingroup$ And it even gets the "theoretically impossible" part wrong. Neither asymmetric cryptography nor Bitcoin was considered "theoretically impossible", at least not by a majority of researchers. As for the "homomorphic encryption, zero-knowledge proofs and secret sharing" - buzzwords, when used like this. $\endgroup$ – MSalters Mar 15 at 10:42
  • 2
    $\begingroup$ A further problem with this idea is that anyone can request the key, even those that do not actually have the encrypted document. Hence, this scheme fails to show whether the document was opened. $\endgroup$ – MSalters Mar 15 at 10:45
  • $\begingroup$ You should be able to use any of the standard secret-splitting techniques to distribute parts of the key across multiple (and also redundant) semi-trusted third parties. Especially if you're already using a distributed trusted party that is blockchain. $\endgroup$ – Toby Speight Mar 16 at 7:42
0
$\begingroup$

This is quite possible in most context. You have reprogrammable memory, and so we see existing technology can easily store a value and control how that value is to be used.

Software or hardware both can independently accomplish this.

Asking if these concepts can be bypassed is simply too broad of a question. There simply is no general principle which describes such a thing. Hardware or software implementation is what distinguishes the answer here, and how such a thing would work. It has nearly nothing to do with a central concept of tamper proof information, and everything to do with the implementation.

I know this isn't what you want to hear, but come on folks you got to get serious. Put the work in.

One thing that helps in actually getting an answer is to clearly define the question. Like what does tampering mean, on a critical thinking level. Maybe we can have a spatial coordinate and time, a boundary, and integer represented in some finitely definable way, contained in a bounded volume. The question then, is there a way to detect if that integer exists elsewhere as an effect of the original, or as a consequence. Was their a physical process that led to some other definable representation of that integer.

But now the question is getting closer to being a solvable question, with a clear, correct discernable answer.

$\endgroup$
4
  • $\begingroup$ The scale of the way the information is represented, is interesting factor... $\endgroup$ – marshal craft Mar 15 at 3:55
  • 1
    $\begingroup$ There have been 6 answers so saying that the question cannot be answered seems a bit strange. Worse, your post doesn't seem to answer the question. $\endgroup$ – Maarten Bodewes Mar 17 at 23:31
  • $\begingroup$ My question does answer this. It say yes it is possible to create a digital seal to tell if a document has been opened. Further it says hardware and or software can accomplish this. The creation of a seal doesn't mean the seal can't be bypassed. For example, the picture of the box, what if I cut a hole in the box next to the opening covered with the seal? What if I simply break the seal. All sorts of stuff. $\endgroup$ – marshal craft Mar 18 at 10:32
  • $\begingroup$ Alright, thanks for the further clarification. $\endgroup$ – Maarten Bodewes Mar 18 at 11:54
0
$\begingroup$

Version control is really the only solution to this as the document would need to be managed.

I would have to say version control over a document is really the only real way to track changes to a file and be able to work off one instance of the document. The reason this is the case is that you need to track state of a document not content. Anything outside of a document management/ version control environment can loose the tracking metadata and be copied over and over. There are caveats to this of course - you will only be able to track the changes in the environment you are in.

For example, You can track the state of documents in Adobe Sign when the are opened by the signer, and also track the changes when they signed the document - this then seals the pdf with a certificate to disable editing.

Another example of change tracking would be the change the tracking details panel in SharePoint. It shows a timeline of all events.

$\endgroup$
2
  • $\begingroup$ Welcome to Cryptography.SE. Could you elaborate more on your solution? This is rather a comment-type answer. $\endgroup$ – kelalaka May 5 at 17:50
  • $\begingroup$ you can edit your answer to improve it. $\endgroup$ – kelalaka May 5 at 19:37
0
$\begingroup$

I know the Word documents, Excel spreadsheets, and PDF files have mechanisms from executing some code when opened. You could create a routine that calls a URL when opened, and that URL would just be a tracker that logs the number of times the document is opened.

There are vulnerabilities. The document needs to have web access when opened. You could have the routine delete all contents if it failed to contact the website.

A determined party could determine the route of the URL, open the document in an isolated network and intercept the URL call to preclude the shell. Or programmatically alter the binary to disable your routine before opening.

This would be a way to keep honest people honest.

$\endgroup$
0
$\begingroup$

A digital storage device that includes a serial number and 'read' counter.

Create your document. Store it on the device. Note the SN and read count.

If the next person reads the document and the read count is not prior + 1, then they know that it has been viewed.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.