Elektronika 2009-11.pdf - Instytut Systemów Elektronicznych

a) will be or could be broken, or
b) a public key certificate of a time stamping authority will be
expired soon or is revoked.
Prior to such an event, the trust to existing time stamps
has to be reassured by means of new time stamping of the
previous archive timestamp. Two types of the time stamp renewal
are used (see details in Section 5):
a) time stamp renewal: the new archive timestamp is generated,
which is related to the previous one; subsequent
timestamps obtained in this renewal procedure form the
archive timestamp chain for a data object or a group of
data objects;
b) hash value renewal: the new time stamp for the archival
form is generated; it is related to previous timestamps and
to data objects stamped with the initial archive timestamp
for the archival form as well; the new set of the archive
timestamp chain is created; the set of one or more archive
timestamp chains forms the archive timestamp sequence.
5. Some technical examples
of the timestamp and hash value renewal
Two standards are presented below (ETSI TS 101 733 [7] and
RFC 4998 [15]). Each of them can be used both for the timestamp
and the hash value renewal. However, while the first
standard is applied mainly to a single data object (an electronic
document or signature), the second one can cover a group of
data objects. In both cases the evidence records are generated
(CAdES-A and EvidenceRecord structures, respectively)
and thent available on each request of the authorized entities.
5.1 ETSI TS 101 733 (CAdES) standard
To keep the probative value of an electronic document the
specification of the archival form CAdES [7] is used. The
archive timestamp is related to each of the SignerInfo data
element that is included into the SignedData. The value of
the messageImprint field of the TimeStampToken (3) structure
contains the hash value returned by the hash algorithm applied
to an input argument being the concatenation of the following
elements:
a) the encapContentInfo field of the SignedData sequence;
when the field is absent, the content is stored outside of
this field, but its value is protected by the signature value located
in the SignedData sequence;
b) the Certificates and crls fields of the SignedData sequence,
if these fields are present in this sequence,
c) all data elements of the SignerInfo sequence, which should
be protected by the generated timestamp token, including
all signed and unsigned attributes.
The SignerInfo can contain more then one instance of
archive-time-stamp attributes. Furthermore, each successive
timestamp protects all timestamps made previously. It means
that the CAdES archival form allows to renew the archive
timestamp using mechanism like this presented on Fig. 1.
Fig. 1. The idea of renewal of an archival timestamps form (CAdES
[7])
Rys. 1. Idea odnawiania znaczników czasu archiwum (CAdES [7])
Each subsequent archive timestamp covers all existing
timestamps, so the archive-time-stamp attribute can be used
also to build the new hash value: it is sufficient to choose the
new stronger hash function, calculate the new hash values
and obtain the new archive timestamps.
5.2 RFC 4998 de facto standard
The proposal published in RFC 4998 [15] contains the following
structure of the evidence record syntax (ERS):
EvidenceRecord ::= SEQUENCE {
version INTEGER { v1(1) },
digestAlgorithms SEQUENCE OF AlgorithmIdentifier,
cryptoInfos [0] CryptoInfos OPTIONAL,
encryptionInfo [1] EncryptionInfo OPTIONAL,
archiveTimeStampSequence ArchiveTimeStampSequence
}
This structure can be treated as an unsigned attribute and
appears only once in each SignerInfo element of the Signed-
Data structure (see the specification of archival form CAdES-A).
The evidence record contains the ArchiveTimeStampSequence
field, which is a sequence of archive timestamp chains:
ArchiveTimeStampSequence ::= SEQUENCE OF
ArchiveTimeStampChain
ArchiveTimeStampChain ::= SEQUENCE OF
ArchiveTimeStamp
The ArchiveTimeStampChain structure contains the
archive timestamps generated as the result of the timestamp
renewal, while the ArchiveTimeStampSequence structure- as
the result of the hash value renewal. The archive timestamp
ArchiveTimestamp includes the timestamp and a set of lists of
hash values and its verification must give a point of time when
a given data object or a group of data objects has existed.
The evidence record EvidenceRecord allows the implementation
of timestamp and hash renewal procedures. The
Fig. 2 is some example of the timestamp renewal used to the
electronic documents divided into groups. Various methods
can be applied to aggregate the group of documents (data objects).
The most effective are this based on an authenticated
dictionary [18], i.e. on data structures viewed simultaneously
as the structured aggregate of all protected information and
the proof of the authenticity and validity of these information.
The initial archive timestamp generated for such aggregated
groups of data is related to lists of hash values, which
allow the verification of the existence of a data object or a
group of data objects at a certain time. The lists of hash values
are generated usually by reduction of an ordered Merkle
hash tree (RFC 4998 [15], M. T. Goodrich, et al. [18]).
7. Conclusions
In order to model a long-term electronic signature scheme LT-
CESS (as defined by Section 3) there is necessary to create
so-called Virtual Signed Electronic Document (V-SED) and introduce
an electronic signature verification algorithm as given
in Equation (6). If there can be found an effective signature
verification algorithm of the form (6), then for a given point in
time it is always possible to assert the authenticity of an electronic
document related to this V-SED and its existence before
a certain moment in the past (in Section 3 a document
ELEKTRONIKA 11/2009 33