Petter Reinholdtsen: Public Trusted Timestamping services for everyone

+#!/bin/sh +set -e +url="http://zeitstempel.dfn.de" +caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt" +reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq) +resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr) +cafile=chain.txt +if [ ! -f $cafile ] ; then + wget -O $cafile "$caurl" +fi +openssl ts -query -data "$1" -cert | tee "$reqfile" \ + | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile" +openssl ts -reply -in "$resfile" -text 1>&2 +openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2 +base64 < "$resfile" +rm "$reqfile" "$resfile" +

Video DVD reader library / python-dvdvideo - nice free software @@ -45,7 +150,7 @@ and genisoimage, but these days I use the marvellous python library and program python-dvdvideo written by Bastian Blank. It is -in Debian +in Debian already and the binary package name is python3-dvdvideo. Instead of trying to read every block from the DVD, it parses the file structure and figure out which block on the DVD is actually in used, @@ -440,7 +545,7 @@ meg en epost hvis du har innspill.

February (3)

March (5)

March (6)

@@ -631,7 +736,7 @@ meg en epost hvis du har innspill.

@@ -685,7 +790,7 @@ meg en epost hvis du har innspill.

diff --git a/blog/index.html b/blog/index.html index 04a36e649e..6a18f73785 100644 --- a/blog/index.html +++ b/blog/index.html @@ -19,6 +19,105 @@ +

Public Trusted Timestamping services for everyone

25th March 2014

Did you ever need to store logs or other files in a way that would +allow it to be used as evidence in court, and needed a way to +demonstrate without reasonable doubt that the file had not been +changed since it was created? Or, did you ever need to document that +a given document was received at some point in time, like some +archived document or the answer to an exam, and not changed after it +was received? The problem in these settings is to remove the need to +trust yourself and your computers, while still being able to prove +that a file is the same as it was at some given time in the past.

+ +

A solution to these problems is to have a trusted third party +"stamp" the document and verify that at some given time the document +looked a given way. Such +notarius service +have been around for thousands of years, and its digital equivalent is +called a +trusted +timestamping service. The Internet +Engineering Task Force standardised how such service could work a +few years ago as RFC +3161. The mechanism is simple. Create a hash of the file in +question, send it to a trusted third party which add a time stamp to +the hash and sign the result with its private key, and send back the +signed hash + timestamp. Anyone with the document and the signature +can then verify that the document matches the signature by creating +their own hash and checking the signature using the trusted third +party public key. There are several commercial services around +providing such timestamping. A quick search for +"rfc 3161 +service" pointed me to at least +DigiStamp, +Quo +Vadis, +Global Sign +and Global +Trust Finder. The system work as long as the private key of the +trusted third party is not compromised.

+ +

But as far as I can tell, there are very few public trusted +timestamp services available for everyone. I've been looking for one +for a while now. But yesterday I found one over at +Deutches +Forschungsnetzmentioned in +a +blog by David MÃ¼ller. I then found a good recipe on how to use +over at the +University +of Greifswald. The OpenSSL library contain both server and tools +to use and set up your own signing service. See the ts(1SSL), +tsget(1SSL) manual pages for more details. The following shell script +demonstrate how to extract a signed timestamp for any file on the disk +in a Debian environment: + +

+#!/bin/sh
+set -e
+url="http://zeitstempel.dfn.de"
+caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt"
+reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq)
+resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr)
+cafile=chain.txt
+if [ ! -f $cafile ] ; then
+    wget -O $cafile "$caurl"
+fi
+openssl ts -query -data "$1" -cert | tee "$reqfile" \
+    | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile"
+openssl ts -reply -in "$resfile" -text 1>&2
+openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2
+base64 < "$resfile"
+rm "$reqfile" "$resfile"
+

+ +

The argument to the script is the file to timestamp, and the output +is a base64 encoded version of the signature to STDOUT and details +about the signature to STDERR. Note that due to +a bug +in the tsget script, you might need to modify the included script +and remove the last line. Or just write your own HTTP uploader using +curl. :) Now you too can prove and verify that files have not been +changed.

+ +

But the Internet need more public trusted timestamp services. +Perhaps something for Uninett or +my work place the University of Oslo +to set up?

+ + + Tags: english, sikkerhet. + + +

Video DVD reader library / python-dvdvideo - nice free software

21st March 2014

@@ -38,7 +137,7 @@ and genisoimage, but these days I use the marvellous python library and program python-dvdvideo written by Bastian Blank. It is -in Debian +in Debian already and the binary package name is python3-dvdvideo. Instead of trying to read every block from the DVD, it parses the file structure and figure out which block on the DVD is actually in used, @@ -747,61 +846,6 @@ activities, please send Bitcoin donations to my address

New chrpath release 0.16

14th January 2014

Coverity is a nice tool to -find problems in C, C++ and Java code using static source code -analysis. It can detect a lot of different problems, and is very -useful to find memory and locking bugs in the error handling part of -the source. The company behind it provide -check of free software projects as -a community service, and many hundred free software projects are -already checked. A few days ago I decided to have a closer look at -the Coverity system, and discovered that the -gnash and -ipmitool -projects I am involved with was already registered. But these are -fairly big, and I would also like to have a small and easy project to -check, and decided to request -checking of the chrpath project. It was -added to the checker and discovered seven potential defects. Six of -these were real, mostly resource "leak" when the program detected an -error. Nothing serious, as the resources would be released a fraction -of a second later when the program exited because of the error, but it -is nice to do it right in case the source of the program some time in -the future end up in a library. Having fixed all defects and added -a -mailing list for the chrpath developers, I decided it was time to -publish a new release. These are the release notes:

- -

New in 0.16 released 2014-01-14:

- -

Fixed all minor bugs discovered by Coverity.
Updated config.sub and config.guess from the GNU project.
Mention new project mailing list in the documentation.

- -

You can -download the -new version 0.16 from alioth. Please let us know via the Alioth -project if something is wrong with the new release. The test suite -did not discover any old errors, so if you find a new one, please also -include a test suite check.

- - - Tags: chrpath, debian, english. - - -

@@ -817,7 +861,7 @@ include a test suite check.

February (3)

March (5)

March (6)

@@ -1008,7 +1052,7 @@ include a test suite check.

@@ -1062,7 +1106,7 @@ include a test suite check.

diff --git a/blog/index.rss b/blog/index.rss index ccf1c4ae1b..f1670fb5b5 100644 --- a/blog/index.rss +++ b/blog/index.rss @@ -6,6 +6,99 @@ http://people.skolelinux.org/pere/blog/ + + Public Trusted Timestamping services for everyone + http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html + http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html + Tue, 25 Mar 2014 12:50:00 +0100 + Did you ever need to store logs or other files in a way that would +allow it to be used as evidence in court, and needed a way to +demonstrate without reasonable doubt that the file had not been +changed since it was created? Or, did you ever need to document that +a given document was received at some point in time, like some +archived document or the answer to an exam, and not changed after it +was received? The problem in these settings is to remove the need to +trust yourself and your computers, while still being able to prove +that a file is the same as it was at some given time in the past. + +A solution to these problems is to have a trusted third party +"stamp" the document and verify that at some given time the document +looked a given way. Such +<a href="https://en.wikipedia.org/wiki/Notarius">notarius</a> service +have been around for thousands of years, and its digital equivalent is +called a +<a href="http://en.wikipedia.org/wiki/Trusted_timestamping">trusted +timestamping service</a>. <a href="http://www.ietf.org/">The Internet +Engineering Task Force</a> standardised how such service could work a +few years ago as <a href="http://tools.ietf.org/html/rfc3161">RFC +3161</a>. The mechanism is simple. Create a hash of the file in +question, send it to a trusted third party which add a time stamp to +the hash and sign the result with its private key, and send back the +signed hash + timestamp. Anyone with the document and the signature +can then verify that the document matches the signature by creating +their own hash and checking the signature using the trusted third +party public key. There are several commercial services around +providing such timestamping. A quick search for +"<a href="https://duckduckgo.com/?q=rfc+3161+service">rfc 3161 +service</a>" pointed me to at least +<a href="https://www.digistamp.com/technical/how-a-digital-time-stamp-works/">DigiStamp</a>, +<a href="http://www.quovadisglobal.co.uk/CertificateServices/SigningServices/TimeStamp.aspx">Quo +Vadis</a>, +<a href="https://www.globalsign.com/timestamp-service/">Global Sign</a> +and <a href="http://www.globaltrustfinder.com/TSADefault.aspx">Global +Trust Finder</a>. The system work as long as the private key of the +trusted third party is not compromised. + +But as far as I can tell, there are very few public trusted +timestamp services available for everyone. I've been looking for one +for a while now. But yesterday I found one over at +<a href="https://www.pki.dfn.de/zeitstempeldienst/">Deutches +Forschungsnetz</a>mentioned in +<a href="http://www.d-mueller.de/blog/dealing-with-trusted-timestamps-in-php-rfc-3161/">a +blog by David MÃ¼ller</a>. I then found a good recipe on how to use +over at the +<a href="http://www.rz.uni-greifswald.de/support/dfn-pki-zertifikate/zeitstempeldienst.html">University +of Greifswald</a>. The OpenSSL library contain both server and tools +to use and set up your own signing service. See the ts(1SSL), +tsget(1SSL) manual pages for more details. The following shell script +demonstrate how to extract a signed timestamp for any file on the disk +in a Debian environment: + +<blockquote><pre> +#!/bin/sh +set -e +url="http://zeitstempel.dfn.de" +caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt" +reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq) +resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr) +cafile=chain.txt +if [ ! -f $cafile ] ; then + wget -O $cafile "$caurl" +fi +openssl ts -query -data "$1" -cert | tee "$reqfile" \ + | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile" +openssl ts -reply -in "$resfile" -text 1>&2 +openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2 +base64 < "$resfile" +rm "$reqfile" "$resfile" +</pre></blockquote> + +The argument to the script is the file to timestamp, and the output +is a base64 encoded version of the signature to STDOUT and details +about the signature to STDERR. Note that due to +<a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742553">a bug +in the tsget script</a>, you might need to modify the included script +and remove the last line. Or just write your own HTTP uploader using +curl. :) Now you too can prove and verify that files have not been +changed. + +But the Internet need more public trusted timestamp services. +Perhaps something for <a href="http://www.uninett.no/">Uninett</a> or +my work place the <a href="http://www.uio.no/">University of Oslo</a> +to set up? + + + Video DVD reader library / python-dvdvideo - nice free software http://people.skolelinux.org/pere/blog/Video_DVD_reader_library___python_dvdvideo___nice_free_software.html @@ -27,7 +120,7 @@ and genisoimage</a>, but these days I use the marvellous python library and program <a href="http://bblank.thinkmo.de/blog/new-software-python-dvdvideo">python-dvdvideo</a> written by Bastian Blank. It is -<a href"http://packages.qa.debian.org/p/python-dvdvideo.html">in Debian +<a href="http://packages.qa.debian.org/p/python-dvdvideo.html">in Debian already</a> and the binary package name is python3-dvdvideo. Instead of trying to read every block from the DVD, it parses the file structure and figure out which block on the DVD is actually in used, @@ -680,54 +773,5 @@ activities, please send Bitcoin donations to my address - - New chrpath release 0.16 - http://people.skolelinux.org/pere/blog/New_chrpath_release_0_16.html - http://people.skolelinux.org/pere/blog/New_chrpath_release_0_16.html - Tue, 14 Jan 2014 11:00:00 +0100 - <a href="http://www.coverity.com/">Coverity</a> is a nice tool to -find problems in C, C++ and Java code using static source code -analysis. It can detect a lot of different problems, and is very -useful to find memory and locking bugs in the error handling part of -the source. The company behind it provide -<a href="https://scan.coverity.com/">check of free software projects as -a community service</a>, and many hundred free software projects are -already checked. A few days ago I decided to have a closer look at -the Coverity system, and discovered that the -<a href="http://www.gnu.org/software/gnash/">gnash</a> and -<a href="http://sourceforge.net/projects/ipmitool/">ipmitool</a> -projects I am involved with was already registered. But these are -fairly big, and I would also like to have a small and easy project to -check, and decided to <a href="http://scan.coverity.com/projects/1179">request -checking of the chrpath project</a>. It was -added to the checker and discovered seven potential defects. Six of -these were real, mostly resource "leak" when the program detected an -error. Nothing serious, as the resources would be released a fraction -of a second later when the program exited because of the error, but it -is nice to do it right in case the source of the program some time in -the future end up in a library. Having fixed all defects and added -<a href="https://lists.alioth.debian.org/mailman/listinfo/chrpath-devel">a -mailing list for the chrpath developers</a>, I decided it was time to -publish a new release. These are the release notes: - -New in 0.16 released 2014-01-14: - -<ul> - - <li>Fixed all minor bugs discovered by Coverity.</li> - <li>Updated config.sub and config.guess from the GNU project.</li> - <li>Mention new project mailing list in the documentation.</li> - -</ul> - -You can -<a href="https://alioth.debian.org/frs/?group_id=31052">download the -new version 0.16 from alioth</a>. Please let us know via the Alioth -project if something is wrong with the new release. The test suite -did not discover any old errors, so if you find a new one, please also -include a test suite check. - - - diff --git a/blog/jXplorer__a_very_nice_LDAP_GUI.html b/blog/jXplorer__a_very_nice_LDAP_GUI.html index eee9466e27..f38fa98014 100644 --- a/blog/jXplorer__a_very_nice_LDAP_GUI.html +++ b/blog/jXplorer__a_very_nice_LDAP_GUI.html @@ -60,7 +60,7 @@ and remove the failing query. Nothing big, but very annoying.

February (3)

March (5)

March (6)

@@ -251,7 +251,7 @@ and remove the failing query. Nothing big, but very annoying.

@@ -305,7 +305,7 @@ and remove the failing query. Nothing big, but very annoying.

diff --git a/blog/sitemap.xml b/blog/sitemap.xml index 0da50afca1..fd57a842cc 100644 --- a/blog/sitemap.xml +++ b/blog/sitemap.xml @@ -1720,6 +1720,11 @@ 0.50 weekly + + http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html + 0.50 + weekly + http://people.skolelinux.org/pere/blog/Radiomerking_med_RFID.html 0.50 diff --git a/blog/systemd__an_interesting_alternative_to_upstart.html b/blog/systemd__an_interesting_alternative_to_upstart.html index 03bc598b0c..ec9ac216ef 100644 --- a/blog/systemd__an_interesting_alternative_to_upstart.html +++ b/blog/systemd__an_interesting_alternative_to_upstart.html @@ -78,7 +78,7 @@ with parallel booting enabled by default.

February (3)

March (5)

March (6)

@@ -269,7 +269,7 @@ with parallel booting enabled by default.

@@ -323,7 +323,7 @@ with parallel booting enabled by default.

diff --git a/blog/tags/3d-printer/index.html b/blog/tags/3d-printer/index.html index ff8f00bb30..4ddae1d035 100644 --- a/blog/tags/3d-printer/index.html +++ b/blog/tags/3d-printer/index.html @@ -610,7 +610,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

February (3)

March (5)

March (6)

@@ -801,7 +801,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -855,7 +855,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

diff --git a/blog/tags/amiga/index.html b/blog/tags/amiga/index.html index 5da1a6c401..9af0cca0fb 100644 --- a/blog/tags/amiga/index.html +++ b/blog/tags/amiga/index.html @@ -64,7 +64,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

February (3)

March (5)

March (6)

@@ -255,7 +255,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -309,7 +309,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

diff --git a/blog/tags/aros/index.html b/blog/tags/aros/index.html index ff19f4ad52..2e8859bd12 100644 --- a/blog/tags/aros/index.html +++ b/blog/tags/aros/index.html @@ -64,7 +64,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

February (3)

March (5)

March (6)

@@ -255,7 +255,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -309,7 +309,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

diff --git a/blog/tags/bankid/index.html b/blog/tags/bankid/index.html index e06adb230a..c092e76154 100644 --- a/blog/tags/bankid/index.html +++ b/blog/tags/bankid/index.html @@ -470,7 +470,7 @@ til BankID-modellen.

February (3)

March (5)

March (6)

@@ -661,7 +661,7 @@ til BankID-modellen.

@@ -715,7 +715,7 @@ til BankID-modellen.

diff --git a/blog/tags/bitcoin/index.html b/blog/tags/bitcoin/index.html index 1c6c6e7ad0..f7189d1812 100644 --- a/blog/tags/bitcoin/index.html +++ b/blog/tags/bitcoin/index.html @@ -591,7 +591,7 @@ donations to the address

February (3)

March (5)

March (6)

@@ -782,7 +782,7 @@ donations to the address

@@ -836,7 +836,7 @@ donations to the address

diff --git a/blog/tags/bootsystem/index.html b/blog/tags/bootsystem/index.html index 4d0442ea98..67da9224a6 100644 --- a/blog/tags/bootsystem/index.html +++ b/blog/tags/bootsystem/index.html @@ -1102,7 +1102,7 @@ insserv'. Will need to test if that work. :)

February (3)

March (5)

March (6)

@@ -1293,7 +1293,7 @@ insserv'. Will need to test if that work. :)

@@ -1347,7 +1347,7 @@ insserv'. Will need to test if that work. :)

diff --git a/blog/tags/bsa/index.html b/blog/tags/bsa/index.html index 6cd93e0dfd..3bb2fceae0 100644 --- a/blog/tags/bsa/index.html +++ b/blog/tags/bsa/index.html @@ -152,7 +152,7 @@ pÃ¥ Slashdot.

February (3)

March (5)

March (6)

@@ -343,7 +343,7 @@ pÃ¥ Slashdot.

@@ -397,7 +397,7 @@ pÃ¥ Slashdot.

diff --git a/blog/tags/chrpath/index.html b/blog/tags/chrpath/index.html index 6a096a1987..41b8ccfe17 100644 --- a/blog/tags/chrpath/index.html +++ b/blog/tags/chrpath/index.html @@ -159,7 +159,7 @@ include a testsuite check.

February (3)

March (5)

March (6)

@@ -350,7 +350,7 @@ include a testsuite check.

@@ -404,7 +404,7 @@ include a testsuite check.

diff --git a/blog/tags/debian edu/index.html b/blog/tags/debian edu/index.html index 6269d7b288..b7c8473123 100644 --- a/blog/tags/debian edu/index.html +++ b/blog/tags/debian edu/index.html @@ -13365,7 +13365,7 @@ be the only one fitting our needs. :/

February (3)

March (5)

March (6)

@@ -13556,7 +13556,7 @@ be the only one fitting our needs. :/

@@ -13610,7 +13610,7 @@ be the only one fitting our needs. :/

diff --git a/blog/tags/debian/index.html b/blog/tags/debian/index.html index 1704e5e99b..ad9fa1eb47 100644 --- a/blog/tags/debian/index.html +++ b/blog/tags/debian/index.html @@ -7500,7 +7500,7 @@ be the only one fitting our needs. :/

February (3)

March (5)

March (6)

@@ -7691,7 +7691,7 @@ be the only one fitting our needs. :/

@@ -7745,7 +7745,7 @@ be the only one fitting our needs. :/

diff --git a/blog/tags/digistan/index.html b/blog/tags/digistan/index.html index cf3c231f5f..47d0daf5fd 100644 --- a/blog/tags/digistan/index.html +++ b/blog/tags/digistan/index.html @@ -1251,7 +1251,7 @@ produkter basert pÃ¥ standarden.

February (3)

March (5)

March (6)

@@ -1442,7 +1442,7 @@ produkter basert pÃ¥ standarden.

@@ -1496,7 +1496,7 @@ produkter basert pÃ¥ standarden.

diff --git a/blog/tags/docbook/index.html b/blog/tags/docbook/index.html index 5f79c018df..6bd614819a 100644 --- a/blog/tags/docbook/index.html +++ b/blog/tags/docbook/index.html @@ -776,7 +776,7 @@ slik at du kan oppdatere direkte.

February (3)

March (5)

March (6)

@@ -967,7 +967,7 @@ slik at du kan oppdatere direkte.

@@ -1021,7 +1021,7 @@ slik at du kan oppdatere direkte.

diff --git a/blog/tags/drivstoffpriser/index.html b/blog/tags/drivstoffpriser/index.html index 66711e69df..6ce6c25928 100644 --- a/blog/tags/drivstoffpriser/index.html +++ b/blog/tags/drivstoffpriser/index.html @@ -493,7 +493,7 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

February (3)

March (5)

March (6)

@@ -684,7 +684,7 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

@@ -738,7 +738,7 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

diff --git a/blog/tags/english/english.rss b/blog/tags/english/english.rss index 2dabde43e1..42f74a7b85 100644 --- a/blog/tags/english/english.rss +++ b/blog/tags/english/english.rss @@ -6,6 +6,99 @@ http://people.skolelinux.org/pere/blog/ + + Public Trusted Timestamping services for everyone + http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html + http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html + Tue, 25 Mar 2014 12:50:00 +0100 + Did you ever need to store logs or other files in a way that would +allow it to be used as evidence in court, and needed a way to +demonstrate without reasonable doubt that the file had not been +changed since it was created? Or, did you ever need to document that +a given document was received at some point in time, like some +archived document or the answer to an exam, and not changed after it +was received? The problem in these settings is to remove the need to +trust yourself and your computers, while still being able to prove +that a file is the same as it was at some given time in the past. + +A solution to these problems is to have a trusted third party +"stamp" the document and verify that at some given time the document +looked a given way. Such +<a href="https://en.wikipedia.org/wiki/Notarius">notarius</a> service +have been around for thousands of years, and its digital equivalent is +called a +<a href="http://en.wikipedia.org/wiki/Trusted_timestamping">trusted +timestamping service</a>. <a href="http://www.ietf.org/">The Internet +Engineering Task Force</a> standardised how such service could work a +few years ago as <a href="http://tools.ietf.org/html/rfc3161">RFC +3161</a>. The mechanism is simple. Create a hash of the file in +question, send it to a trusted third party which add a time stamp to +the hash and sign the result with its private key, and send back the +signed hash + timestamp. Anyone with the document and the signature +can then verify that the document matches the signature by creating +their own hash and checking the signature using the trusted third +party public key. There are several commercial services around +providing such timestamping. A quick search for +"<a href="https://duckduckgo.com/?q=rfc+3161+service">rfc 3161 +service</a>" pointed me to at least +<a href="https://www.digistamp.com/technical/how-a-digital-time-stamp-works/">DigiStamp</a>, +<a href="http://www.quovadisglobal.co.uk/CertificateServices/SigningServices/TimeStamp.aspx">Quo +Vadis</a>, +<a href="https://www.globalsign.com/timestamp-service/">Global Sign</a> +and <a href="http://www.globaltrustfinder.com/TSADefault.aspx">Global +Trust Finder</a>. The system work as long as the private key of the +trusted third party is not compromised. + +But as far as I can tell, there are very few public trusted +timestamp services available for everyone. I've been looking for one +for a while now. But yesterday I found one over at +<a href="https://www.pki.dfn.de/zeitstempeldienst/">Deutches +Forschungsnetz</a>mentioned in +<a href="http://www.d-mueller.de/blog/dealing-with-trusted-timestamps-in-php-rfc-3161/">a +blog by David MÃ¼ller</a>. I then found a good recipe on how to use +over at the +<a href="http://www.rz.uni-greifswald.de/support/dfn-pki-zertifikate/zeitstempeldienst.html">University +of Greifswald</a>. The OpenSSL library contain both server and tools +to use and set up your own signing service. See the ts(1SSL), +tsget(1SSL) manual pages for more details. The following shell script +demonstrate how to extract a signed timestamp for any file on the disk +in a Debian environment: + +<blockquote><pre> +#!/bin/sh +set -e +url="http://zeitstempel.dfn.de" +caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt" +reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq) +resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr) +cafile=chain.txt +if [ ! -f $cafile ] ; then + wget -O $cafile "$caurl" +fi +openssl ts -query -data "$1" -cert | tee "$reqfile" \ + | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile" +openssl ts -reply -in "$resfile" -text 1>&2 +openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2 +base64 < "$resfile" +rm "$reqfile" "$resfile" +</pre></blockquote> + +The argument to the script is the file to timestamp, and the output +is a base64 encoded version of the signature to STDOUT and details +about the signature to STDERR. Note that due to +<a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742553">a bug +in the tsget script</a>, you might need to modify the included script +and remove the last line. Or just write your own HTTP uploader using +curl. :) Now you too can prove and verify that files have not been +changed. + +But the Internet need more public trusted timestamp services. +Perhaps something for <a href="http://www.uninett.no/">Uninett</a> or +my work place the <a href="http://www.uio.no/">University of Oslo</a> +to set up? + + + Video DVD reader library / python-dvdvideo - nice free software http://people.skolelinux.org/pere/blog/Video_DVD_reader_library___python_dvdvideo___nice_free_software.html @@ -27,7 +120,7 @@ and genisoimage</a>, but these days I use the marvellous python library and program <a href="http://bblank.thinkmo.de/blog/new-software-python-dvdvideo">python-dvdvideo</a> written by Bastian Blank. It is -<a href"http://packages.qa.debian.org/p/python-dvdvideo.html">in Debian +<a href="http://packages.qa.debian.org/p/python-dvdvideo.html">in Debian already</a> and the binary package name is python3-dvdvideo. Instead of trying to read every block from the DVD, it parses the file structure and figure out which block on the DVD is actually in used, diff --git a/blog/tags/english/index.html b/blog/tags/english/index.html index 3c230928dc..518eec2802 100644 --- a/blog/tags/english/index.html +++ b/blog/tags/english/index.html @@ -20,6 +20,111 @@

Entries tagged "english".

+ Public Trusted Timestamping services for everyone +

+ 25th March 2014 +

+ +

+#!/bin/sh
+set -e
+url="http://zeitstempel.dfn.de"
+caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt"
+reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq)
+resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr)
+cafile=chain.txt
+if [ ! -f $cafile ] ; then
+    wget -O $cafile "$caurl"
+fi
+openssl ts -query -data "$1" -cert | tee "$reqfile" \
+    | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile"
+openssl ts -reply -in "$resfile" -text 1>&2
+openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2
+base64 < "$resfile"
+rm "$reqfile" "$resfile"
+

+ +

But the Internet need more public trusted timestamp services. +Perhaps something for Uninett or +my work place the University of Oslo +to set up?

+ +

+ + + Tags: english, sikkerhet. + + +

Video DVD reader library / python-dvdvideo - nice free software @@ -44,7 +149,7 @@ and genisoimage, but these days I use the marvellous python library and program python-dvdvideo written by Bastian Blank. It is -in Debian +in Debian already and the binary package name is python3-dvdvideo. Instead of trying to read every block from the DVD, it parses the file structure and figure out which block on the DVD is actually in used, @@ -19110,7 +19215,7 @@ be the only one fitting our needs. :/

February (3)

March (5)

March (6)

@@ -19301,7 +19406,7 @@ be the only one fitting our needs. :/

@@ -19355,7 +19460,7 @@ be the only one fitting our needs. :/

diff --git a/blog/tags/fiksgatami/index.html b/blog/tags/fiksgatami/index.html index 8d1a4d8bf7..847ae398e9 100644 --- a/blog/tags/fiksgatami/index.html +++ b/blog/tags/fiksgatami/index.html @@ -1267,7 +1267,7 @@ med dem. Dette blir bra.

February (3)

March (5)

March (6)

@@ -1458,7 +1458,7 @@ med dem. Dette blir bra.

@@ -1512,7 +1512,7 @@ med dem. Dette blir bra.

diff --git a/blog/tags/fildeling/index.html b/blog/tags/fildeling/index.html index 96fdf6d47f..3d19b04b65 100644 --- a/blog/tags/fildeling/index.html +++ b/blog/tags/fildeling/index.html @@ -637,7 +637,7 @@ og fildeling av slike filer er fullt ut lovlig.

February (3)

March (5)

March (6)

@@ -828,7 +828,7 @@ og fildeling av slike filer er fullt ut lovlig.

@@ -882,7 +882,7 @@ og fildeling av slike filer er fullt ut lovlig.

diff --git a/blog/tags/freeculture/index.html b/blog/tags/freeculture/index.html index 68066b0d5a..8265ff8d7a 100644 --- a/blog/tags/freeculture/index.html +++ b/blog/tags/freeculture/index.html @@ -891,7 +891,7 @@ slik at du kan oppdatere direkte.

February (3)

March (5)

March (6)

@@ -1082,7 +1082,7 @@ slik at du kan oppdatere direkte.

@@ -1136,7 +1136,7 @@ slik at du kan oppdatere direkte.

diff --git a/blog/tags/freedombox/index.html b/blog/tags/freedombox/index.html index 31e5ba0f4e..b53f903be3 100644 --- a/blog/tags/freedombox/index.html +++ b/blog/tags/freedombox/index.html @@ -709,7 +709,7 @@ default password is 'secret'.

February (3)

March (5)

March (6)

@@ -900,7 +900,7 @@ default password is 'secret'.

@@ -954,7 +954,7 @@ default password is 'secret'.

diff --git a/blog/tags/frikanalen/index.html b/blog/tags/frikanalen/index.html index cd7d2a3f35..52db54bdf1 100644 --- a/blog/tags/frikanalen/index.html +++ b/blog/tags/frikanalen/index.html @@ -975,7 +975,7 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

February (3)

March (5)

March (6)

@@ -1166,7 +1166,7 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

@@ -1220,7 +1220,7 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

diff --git a/blog/tags/intervju/index.html b/blog/tags/intervju/index.html index 44713b10e0..ea974e34e1 100644 --- a/blog/tags/intervju/index.html +++ b/blog/tags/intervju/index.html @@ -4732,7 +4732,7 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

February (3)

March (5)

March (6)

@@ -4923,7 +4923,7 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

@@ -4977,7 +4977,7 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

diff --git a/blog/tags/isenkram/index.html b/blog/tags/isenkram/index.html index 5008b5f4ca..cef8817526 100644 --- a/blog/tags/isenkram/index.html +++ b/blog/tags/isenkram/index.html @@ -789,7 +789,7 @@ please send me an email. :)

February (3)

March (5)

March (6)

@@ -980,7 +980,7 @@ please send me an email. :)

@@ -1034,7 +1034,7 @@ please send me an email. :)

diff --git a/blog/tags/kart/index.html b/blog/tags/kart/index.html index f62d83f1f6..bde5f5dead 100644 --- a/blog/tags/kart/index.html +++ b/blog/tags/kart/index.html @@ -1136,7 +1136,7 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

February (3)

March (5)

March (6)

@@ -1327,7 +1327,7 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

@@ -1381,7 +1381,7 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

diff --git a/blog/tags/ldap/index.html b/blog/tags/ldap/index.html index c3de7f2e87..97e6ef5a0d 100644 --- a/blog/tags/ldap/index.html +++ b/blog/tags/ldap/index.html @@ -1054,7 +1054,7 @@ new IETF work group?

February (3)

March (5)

March (6)

@@ -1245,7 +1245,7 @@ new IETF work group?

@@ -1299,7 +1299,7 @@ new IETF work group?

diff --git a/blog/tags/lenker/index.html b/blog/tags/lenker/index.html index 80f7f122b6..086c38d2ff 100644 --- a/blog/tags/lenker/index.html +++ b/blog/tags/lenker/index.html @@ -475,7 +475,7 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

February (3)

March (5)

March (6)

@@ -666,7 +666,7 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

@@ -720,7 +720,7 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

diff --git a/blog/tags/ltsp/index.html b/blog/tags/ltsp/index.html index cf93d30fac..9e53fb3d4c 100644 --- a/blog/tags/ltsp/index.html +++ b/blog/tags/ltsp/index.html @@ -69,7 +69,7 @@ of these cards.

February (3)

March (5)

March (6)

@@ -260,7 +260,7 @@ of these cards.

@@ -314,7 +314,7 @@ of these cards.

diff --git a/blog/tags/mesh network/index.html b/blog/tags/mesh network/index.html index ff31cc926e..b921928fbf 100644 --- a/blog/tags/mesh network/index.html +++ b/blog/tags/mesh network/index.html @@ -673,7 +673,7 @@ mesh system.

February (3)

March (5)

March (6)

@@ -864,7 +864,7 @@ mesh system.

@@ -918,7 +918,7 @@ mesh system.

diff --git a/blog/tags/multimedia/index.html b/blog/tags/multimedia/index.html index cc73bfdfaa..a9c3eb9d01 100644 --- a/blog/tags/multimedia/index.html +++ b/blog/tags/multimedia/index.html @@ -44,7 +44,7 @@ and genisoimage, but these days I use the marvellous python library and program python-dvdvideo written by Bastian Blank. It is -in Debian +in Debian already and the binary package name is python3-dvdvideo. Instead of trying to read every block from the DVD, it parses the file structure and figure out which block on the DVD is actually in used, @@ -1945,7 +1945,7 @@ be the only one fitting our needs. :/

February (3)

March (5)

March (6)

@@ -2136,7 +2136,7 @@ be the only one fitting our needs. :/

@@ -2190,7 +2190,7 @@ be the only one fitting our needs. :/

diff --git a/blog/tags/multimedia/multimedia.rss b/blog/tags/multimedia/multimedia.rss index cf520871ab..cb31706909 100644 --- a/blog/tags/multimedia/multimedia.rss +++ b/blog/tags/multimedia/multimedia.rss @@ -27,7 +27,7 @@ and genisoimage</a>, but these days I use the marvellous python library and program <a href="http://bblank.thinkmo.de/blog/new-software-python-dvdvideo">python-dvdvideo</a> written by Bastian Blank. It is -<a href"http://packages.qa.debian.org/p/python-dvdvideo.html">in Debian +<a href="http://packages.qa.debian.org/p/python-dvdvideo.html">in Debian already</a> and the binary package name is python3-dvdvideo. Instead of trying to read every block from the DVD, it parses the file structure and figure out which block on the DVD is actually in used, diff --git a/blog/tags/norsk/index.html b/blog/tags/norsk/index.html index 07c73fe1cc..6a790b4c0b 100644 --- a/blog/tags/norsk/index.html +++ b/blog/tags/norsk/index.html @@ -18280,7 +18280,7 @@ forsÃ¸k.

February (3)

March (5)

March (6)

@@ -18471,7 +18471,7 @@ forsÃ¸k.

@@ -18525,7 +18525,7 @@ forsÃ¸k.

diff --git a/blog/tags/nuug/index.html b/blog/tags/nuug/index.html index 7a30ef2df1..901b17ab72 100644 --- a/blog/tags/nuug/index.html +++ b/blog/tags/nuug/index.html @@ -10692,7 +10692,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

February (3)

March (5)

March (6)

@@ -10883,7 +10883,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -10937,7 +10937,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

diff --git a/blog/tags/offentlig innsyn/index.html b/blog/tags/offentlig innsyn/index.html index 42b39838dd..87d564d2ab 100644 --- a/blog/tags/offentlig innsyn/index.html +++ b/blog/tags/offentlig innsyn/index.html @@ -1093,7 +1093,7 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

February (3)

March (5)

March (6)

@@ -1284,7 +1284,7 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

@@ -1338,7 +1338,7 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

diff --git a/blog/tags/open311/index.html b/blog/tags/open311/index.html index 7fee8b216a..5feea490dd 100644 --- a/blog/tags/open311/index.html +++ b/blog/tags/open311/index.html @@ -164,7 +164,7 @@ work like the free software project communities I am used to.

February (3)

March (5)

March (6)

@@ -355,7 +355,7 @@ work like the free software project communities I am used to.

@@ -409,7 +409,7 @@ work like the free software project communities I am used to.

diff --git a/blog/tags/opphavsrett/index.html b/blog/tags/opphavsrett/index.html index eec345375d..3ad76d3ea2 100644 --- a/blog/tags/opphavsrett/index.html +++ b/blog/tags/opphavsrett/index.html @@ -44,7 +44,7 @@ and genisoimage, but these days I use the marvellous python library and program python-dvdvideo written by Bastian Blank. It is -in Debian +in Debian already and the binary package name is python3-dvdvideo. Instead of trying to read every block from the DVD, it parses the file structure and figure out which block on the DVD is actually in used, @@ -3447,7 +3447,7 @@ og endrer pÃ¥ betingelsene.

February (3)

March (5)

March (6)

@@ -3638,7 +3638,7 @@ og endrer pÃ¥ betingelsene.

@@ -3692,7 +3692,7 @@ og endrer pÃ¥ betingelsene.

diff --git a/blog/tags/opphavsrett/opphavsrett.rss b/blog/tags/opphavsrett/opphavsrett.rss index d23bbc0459..2b473e2bcb 100644 --- a/blog/tags/opphavsrett/opphavsrett.rss +++ b/blog/tags/opphavsrett/opphavsrett.rss @@ -27,7 +27,7 @@ and genisoimage</a>, but these days I use the marvellous python library and program <a href="http://bblank.thinkmo.de/blog/new-software-python-dvdvideo">python-dvdvideo</a> written by Bastian Blank. It is -<a href"http://packages.qa.debian.org/p/python-dvdvideo.html">in Debian +<a href="http://packages.qa.debian.org/p/python-dvdvideo.html">in Debian already</a> and the binary package name is python3-dvdvideo. Instead of trying to read every block from the DVD, it parses the file structure and figure out which block on the DVD is actually in used, diff --git a/blog/tags/personvern/index.html b/blog/tags/personvern/index.html index cab10ff9d8..8076c2cb50 100644 --- a/blog/tags/personvern/index.html +++ b/blog/tags/personvern/index.html @@ -5754,7 +5754,7 @@ kontanter for noen dager siden.

February (3)

March (5)

March (6)

@@ -5945,7 +5945,7 @@ kontanter for noen dager siden.

@@ -5999,7 +5999,7 @@ kontanter for noen dager siden.

diff --git a/blog/tags/raid/index.html b/blog/tags/raid/index.html index 17163a5a5c..dc3094d8df 100644 --- a/blog/tags/raid/index.html +++ b/blog/tags/raid/index.html @@ -105,7 +105,7 @@ disk(s) is failing when the RAID is running short on disks.

February (3)

March (5)

March (6)

@@ -296,7 +296,7 @@ disk(s) is failing when the RAID is running short on disks.

@@ -350,7 +350,7 @@ disk(s) is failing when the RAID is running short on disks.

diff --git a/blog/tags/reprap/index.html b/blog/tags/reprap/index.html index 0089117cac..3d8f7dc357 100644 --- a/blog/tags/reprap/index.html +++ b/blog/tags/reprap/index.html @@ -531,7 +531,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

February (3)

March (5)

March (6)

@@ -722,7 +722,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -776,7 +776,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

diff --git a/blog/tags/rfid/index.html b/blog/tags/rfid/index.html index 980f5ba709..25330019a2 100644 --- a/blog/tags/rfid/index.html +++ b/blog/tags/rfid/index.html @@ -154,7 +154,7 @@ mer om de nye biometriske passene.

February (3)

March (5)

March (6)

@@ -345,7 +345,7 @@ mer om de nye biometriske passene.

@@ -399,7 +399,7 @@ mer om de nye biometriske passene.

diff --git a/blog/tags/robot/index.html b/blog/tags/robot/index.html index cf06eb50c3..5563ac3c09 100644 --- a/blog/tags/robot/index.html +++ b/blog/tags/robot/index.html @@ -469,7 +469,7 @@ firmwaren. :)

February (3)

March (5)

March (6)

@@ -660,7 +660,7 @@ firmwaren. :)

@@ -714,7 +714,7 @@ firmwaren. :)

diff --git a/blog/tags/rss/index.html b/blog/tags/rss/index.html index 6561b501a2..119df8dc48 100644 --- a/blog/tags/rss/index.html +++ b/blog/tags/rss/index.html @@ -58,7 +58,7 @@ forsÃ¸k.

February (3)

March (5)

March (6)

@@ -249,7 +249,7 @@ forsÃ¸k.

@@ -303,7 +303,7 @@ forsÃ¸k.

diff --git a/blog/tags/ruter/index.html b/blog/tags/ruter/index.html index 6651c786a3..b872d6073c 100644 --- a/blog/tags/ruter/index.html +++ b/blog/tags/ruter/index.html @@ -212,7 +212,7 @@ OsloomrÃ¥det.

February (3)

March (5)

March (6)

@@ -403,7 +403,7 @@ OsloomrÃ¥det.

@@ -457,7 +457,7 @@ OsloomrÃ¥det.

diff --git a/blog/tags/scraperwiki/index.html b/blog/tags/scraperwiki/index.html index c9329cb32f..28a74e0929 100644 --- a/blog/tags/scraperwiki/index.html +++ b/blog/tags/scraperwiki/index.html @@ -147,7 +147,7 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

February (3)

March (5)

March (6)

@@ -338,7 +338,7 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

@@ -392,7 +392,7 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

diff --git a/blog/tags/sikkerhet/index.html b/blog/tags/sikkerhet/index.html index 4ad242af79..d2fae3c7d1 100644 --- a/blog/tags/sikkerhet/index.html +++ b/blog/tags/sikkerhet/index.html @@ -20,6 +20,111 @@

Entries tagged "sikkerhet".

+ Public Trusted Timestamping services for everyone +

+ 25th March 2014 +

+ +

+#!/bin/sh
+set -e
+url="http://zeitstempel.dfn.de"
+caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt"
+reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq)
+resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr)
+cafile=chain.txt
+if [ ! -f $cafile ] ; then
+    wget -O $cafile "$caurl"
+fi
+openssl ts -query -data "$1" -cert | tee "$reqfile" \
+    | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile"
+openssl ts -reply -in "$resfile" -text 1>&2
+openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2
+base64 < "$resfile"
+rm "$reqfile" "$resfile"
+

+ +

But the Internet need more public trusted timestamp services. +Perhaps something for Uninett or +my work place the University of Oslo +to set up?

+ +

+ + + Tags: english, sikkerhet. + + +

Freedombox on Dreamplug, Raspberry Pi and virtual x86 machine @@ -2422,7 +2527,7 @@ betydelige.

February (3)

March (5)

March (6)

@@ -2613,7 +2718,7 @@ betydelige.

@@ -2667,7 +2772,7 @@ betydelige.

diff --git a/blog/tags/sikkerhet/sikkerhet.rss b/blog/tags/sikkerhet/sikkerhet.rss index d1f2f3be42..7edc63195a 100644 --- a/blog/tags/sikkerhet/sikkerhet.rss +++ b/blog/tags/sikkerhet/sikkerhet.rss @@ -6,6 +6,99 @@ http://people.skolelinux.org/pere/blog/ + + Public Trusted Timestamping services for everyone + http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html + http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html + Tue, 25 Mar 2014 12:50:00 +0100 + Did you ever need to store logs or other files in a way that would +allow it to be used as evidence in court, and needed a way to +demonstrate without reasonable doubt that the file had not been +changed since it was created? Or, did you ever need to document that +a given document was received at some point in time, like some +archived document or the answer to an exam, and not changed after it +was received? The problem in these settings is to remove the need to +trust yourself and your computers, while still being able to prove +that a file is the same as it was at some given time in the past. + +A solution to these problems is to have a trusted third party +"stamp" the document and verify that at some given time the document +looked a given way. Such +<a href="https://en.wikipedia.org/wiki/Notarius">notarius</a> service +have been around for thousands of years, and its digital equivalent is +called a +<a href="http://en.wikipedia.org/wiki/Trusted_timestamping">trusted +timestamping service</a>. <a href="http://www.ietf.org/">The Internet +Engineering Task Force</a> standardised how such service could work a +few years ago as <a href="http://tools.ietf.org/html/rfc3161">RFC +3161</a>. The mechanism is simple. Create a hash of the file in +question, send it to a trusted third party which add a time stamp to +the hash and sign the result with its private key, and send back the +signed hash + timestamp. Anyone with the document and the signature +can then verify that the document matches the signature by creating +their own hash and checking the signature using the trusted third +party public key. There are several commercial services around +providing such timestamping. A quick search for +"<a href="https://duckduckgo.com/?q=rfc+3161+service">rfc 3161 +service</a>" pointed me to at least +<a href="https://www.digistamp.com/technical/how-a-digital-time-stamp-works/">DigiStamp</a>, +<a href="http://www.quovadisglobal.co.uk/CertificateServices/SigningServices/TimeStamp.aspx">Quo +Vadis</a>, +<a href="https://www.globalsign.com/timestamp-service/">Global Sign</a> +and <a href="http://www.globaltrustfinder.com/TSADefault.aspx">Global +Trust Finder</a>. The system work as long as the private key of the +trusted third party is not compromised. + +But as far as I can tell, there are very few public trusted +timestamp services available for everyone. I've been looking for one +for a while now. But yesterday I found one over at +<a href="https://www.pki.dfn.de/zeitstempeldienst/">Deutches +Forschungsnetz</a>mentioned in +<a href="http://www.d-mueller.de/blog/dealing-with-trusted-timestamps-in-php-rfc-3161/">a +blog by David MÃ¼ller</a>. I then found a good recipe on how to use +over at the +<a href="http://www.rz.uni-greifswald.de/support/dfn-pki-zertifikate/zeitstempeldienst.html">University +of Greifswald</a>. The OpenSSL library contain both server and tools +to use and set up your own signing service. See the ts(1SSL), +tsget(1SSL) manual pages for more details. The following shell script +demonstrate how to extract a signed timestamp for any file on the disk +in a Debian environment: + +<blockquote><pre> +#!/bin/sh +set -e +url="http://zeitstempel.dfn.de" +caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt" +reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq) +resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr) +cafile=chain.txt +if [ ! -f $cafile ] ; then + wget -O $cafile "$caurl" +fi +openssl ts -query -data "$1" -cert | tee "$reqfile" \ + | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile" +openssl ts -reply -in "$resfile" -text 1>&2 +openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2 +base64 < "$resfile" +rm "$reqfile" "$resfile" +</pre></blockquote> + +The argument to the script is the file to timestamp, and the output +is a base64 encoded version of the signature to STDOUT and details +about the signature to STDERR. Note that due to +<a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742553">a bug +in the tsget script</a>, you might need to modify the included script +and remove the last line. Or just write your own HTTP uploader using +curl. :) Now you too can prove and verify that files have not been +changed. + +But the Internet need more public trusted timestamp services. +Perhaps something for <a href="http://www.uninett.no/">Uninett</a> or +my work place the <a href="http://www.uio.no/">University of Oslo</a> +to set up? + + + Freedombox on Dreamplug, Raspberry Pi and virtual x86 machine http://people.skolelinux.org/pere/blog/Freedombox_on_Dreamplug__Raspberry_Pi_and_virtual_x86_machine.html

+ Petter Reinholdtsen + +

Archive

Tags

Entries from March 2014.

Entries tagged "english".

Entries tagged "sikkerhet".