Comments on Rainer's Blog: Announcing LogStore

IANAL, but for the purpose of presenting a log as ...

2011-12-13T12:58:26.399+01:00

IANAL, but for the purpose of presenting a log as evidence in a court room, there is the question of secure enough. Hand signatures on paper is considered secure enough. DNA sampled by a police officer is considered secure enough. But you can never be completely certain that the police officer hasn't tampered with the DNA sample. And it is possible to forge a hand signature on paper.

With that in mind, if it is very difficult to retrieve the secret private key, then it may be secure enough for the court. If one can point to established procedures and security measures, and they are approved and trusted by the court, then the log can be used as proof.

With this in mind, I belive there is sufficient reason for creating a PKI-secured logging system. In my opinion it's not a waste of time.

As I said, you can proof that the signature is cor...

2011-12-13T11:10:53.900+01:00

As I said, you can proof that the signature is correct assuming that the signing key was not compromised. If you assume that keys are compromised then you are of course right: with a compromised key you can not have any security at all. So under this assumption, you can never build any secure system.

My reference to https was to talk about the strength of cryptography. It is not a signature protocol.

Hi, Rainer wrote: > HOWEVER, you can get such ...

2011-12-13T10:22:56.170+01:00

Hi,

Rainer wrote:
> HOWEVER, you can get such a message store on rewritable media
> "sufficiently" secure. By "sufficient" I meant secure in the
> same level as HTTPS, online banking, PGP, etc. are secure. Think
> about PGP signed mail.

Mhh... maybe we have to define the wanted result first.

When you are talking about HTTPS, you are talking about a secured connection. This security is based on the fact that you have to trust the remote's SSL key.
I won't go into the problems PKI is currently suffering, but all you do is trusting that you are talking to the system you want to talk to. The SSL key is your "proof", but this proof is nothing:

- You would need to know the fingerprint of every certificate in the chain to verify

- And even you know every fingerprint, you cannot be sure if some bad guy has stolen the key

So what does HTTPS do? It just securing the connection between you and the endpoint you are connected, using the known key. But it cannot guarantee that the current key user is the designated key owner. Everyone should keep this in mind.

The same applies to PGP:
A PGP signature is nothing. It's just saying, that the person who created the signature had access to the required private key and the passphrase at creation time.

As you have to trust the SSL key integrity, you have to trust the PGP's key integrity.

So what do you (and other) want to achieve/proof with that feature?

Thanks for the comments. Indeed, the checksum-only...

2011-12-12T12:49:51.941+01:00

Thanks for the comments. Indeed, the checksum-only thing is broken. But this is meant only as a starter, and maybe to see how much interest there actually is. I, too, was surprised how many people seemed to like the simple checksum chain that was proposed with journald. But in the light of that, I'd say there is some value in feeding this need (and there were some arguments that back this -- guess I need to write yet another blog post ;)).

HOWEVER, you can get such a message store on rewritable media "sufficiently" secure. By "sufficient" I meant secure in the same level as HTTPS, online banking, PGP, etc. are secure. Think about PGP signed mail. There is a big difference between a simple hash chain and a digital signature - less in code to do it, but in security. While it is easy to recompute hashes (as long as no record of previous hashes was saved), it is "impossible" to mangle the signature ("impossible", again, under the same constraints we do all of our crypto stuff - so if someone finds a polynominal time algorithm to factor prime numbers, no security remains for the usual algorithms).

The idea is to extend LogStore with signature records. This means at closure (or any n records written), a record is added that contains the latest hash and *that* records is digitally signed (by public/private key cryptography). In that case, you can still recompute the checksums, but then the checksums will not match the signed record (or the signature be broken, if the latter is modified as well).

So, yes, it is possible to make a log store "revisionssicher" (audit-gradness). That will also give you benefit when used as evidence in court.

While it may not be possible to make it completely...

2011-12-12T10:02:23.940+01:00

While it may not be possible to make it completely tamper proof, I think a major point is to make it hard to manipulate logs. This can potentially make it very hard as long as the secret key is kept secret. There are Hardware Security Modules (HSM) that can make retrieving the key very hard.

Hi, are you really sure you aren't wasting yo...

2011-12-08T20:16:55.647+01:00

Hi,

are you really sure you aren't wasting your time? Don't get me wrong, but a secure storage on a rewritable medium is fiction.

You said it, too:
"As such, manipulations inside the log store can be detected, as long as the checksums of all records are not also recomputed."

Isn't that what an attacker will do? Recompute all records to hide his traces?

That's what will happen everytime: You know there's one way, then you will find it...

I understand the idea, I also like it. But because I don't see a way how this could work, why do you spend so much time on it?

What's the benefit?

I think you have heard about the German Staatstrojaner. It is important for legal usage, that you provide some kind of "revisionssicher" storage.

You wrote it, the CCC has proofed it, other have proofed it too - this isn't possible with rewritable storage mediums.

So again: What's the benefit? Why do you spend so much time on it?

Aren't you creating a imagination of security?

Please, don't get me wrong. I like your work, but I really don't understand how you could get on that train...

Currently I would recommend: Leave it asap.