Cryptographically timestamping all your Git commits automatically

http://www.gwern.net/Archiving%20URLs#cryptographic-timestamping

by gwern • 11 years ago

53 28 11 years ago

rlpb• 11 years ago

This is quite useful. But to have full confidence in it, I'd like to see:

1) No reliance on external archives, so all the data required to prove a timestamp should be automatically downloaded after the stamp has hit the blockchain. This should certainly include the necessary subset of the "OriginStamp archives". I'm not sure if it needs to include the blockchain or not.

2) Automatic verification that my requested timestamps have hit the blockchain on schedule and the data required to prove the timestamp downloaded and saved.

Both of these could be done in client software - I have no objection to the principle of the system which seems sound to me.

placeybordeaux• 11 years ago

You want to know that the block that has OriginStamp's proof in it has been built upon, otherwise they could (at cost of the singular block) produce false blocks. This would obviously hurt their reputation, but it's not out of the question.

gwern8• 11 years ago

1) No reliance on external archives, so all the data required to prove a timestamp should be automatically downloaded after the stamp has hit the blockchain. This should certainly include the necessary subset of the "OriginStamp archives".

I agree that ideally one would somehow get that data automatically as well (it's just that writing the scripts for automatically submitting is much easier than writing scripts for automatically retrieving...) I've already emailed the two OriginStamp devs asking for thoughts on how users could automatically get the list of hashes for each day that concerns them.

There's some email functionality in OriginStamp which might be reusable for this purpose, in which case one could include one's email address in the shell script and get one email a day listing the hashes you made and containing an attachment with that day's total hashes (so you can verify that your hashes are in the master list, that the master list hashes to the master hash, and then look up whether that master hash's corresponding Bitcoin address has received a transaction or not that day).

brohee5• 11 years ago

Talking cryptographic timestamping and talking only about random brodude startups and not about established, working standard like RFC 3161/3628 and the many digital notaries offering the service...

Seriously?

gwern8• 11 years ago

Are any of those digital notaries provably decentralized, secure, free, and scriptable in one or two lines?

brohee5• 11 years ago

Decentralized no, but free and scriptable yes

E.g. https://startssl.com/?app=25#61

Decentralized not usable in a legal context in any jurisdiction I can think of, and why do you timestamp if not to cover your ass?

kazinator4• 11 years ago

The most robust way of timestamping is cryptographic timestamping, where the downloaded file is hashed using a cryptographic hash function like SHA-256, and then the hash is published.

How is this a time stamp? The hash doesn't change if you touch the file's modification time.

arethuza• 11 years ago

I suspect that means that the file hash is published to a trusted third party who then combines the hash with a timestamp:

https://en.wikipedia.org/wiki/Trusted_timestamping

michaelt• 11 years ago

Sometimes it's useful to be able to prove a file was created /before/ a given time.

For example, if you download a signed executable, but the signing certificate expired a while ago, does that mean you don't trust the executable? If you don't trust it, every executable would eventually break when the signing certificate went out of date. The solution is to require a cryptographic timestamp proving the executable was generated at a time when the code signing certificate was valid.

That's how you can download Java applets that were published and signed in 2005 and still know the signature is valid. Not that many people are using that technology these days!

gwern8• 11 years ago

Sometimes it's useful to be able to prove a file was created /before/ a given time.

Let me give a personal example: some time ago, someone deleted the public copies of some webpages we were using in our investigation and threatened to us that if we continued, they would simply claim that our copies of were forged later (after we had contacted them), and, they thought, make us look like fools & scuttle our claims (with some hints that they might also sue us for libel to boot). Fortunately, I had been timestamping all along and had timestamped the archived webpages in question; so I could prove that my copies are unaltered from well before they raised the question, and, further, at around the same time as they were independently captured in a different archive service. After we noted this to them, they had to back down on the threats and take us more seriously.

kazinator4• 11 years ago

If you download a signed executable, but the signing certificate expired a while ago, does that mean you don't trust the executable?

Indeed, no you don't---not on the basis of cryptographic reasoning, at least.

Certificates expire for a reason. That reason is the assumption that they are being actively cracked, and so have a limited shelf life. You can trust a 2005 certificate only to the extent that you bank on the underlying private key not to have been cracked.

If the key is cracked, then the attackers can create a brand new file, and make it look like its existence had been certified in 2005.

Old stuff that still matters has to be re-certified with new certificates in the face the impending expiry of the old ones.

aeorgnoieang• 11 years ago

Publishing, in a way that can later be verified, provides the time component.

beagle32• 11 years ago

The main problem is relying on Git's SHA1s for security. Git was not designed for security - it was a nice side effect while SHA-1 was dependable. But it isn't any more; a method for finding freestart collisions ("SHAppening" [0]) is already known, and it is expected that standard collisions will be found within a year. (Preimages are not expected for a few decades or hundred years though)

For the use described here, however - proving to someone else that you had a specific repository content - collision availability renders a proof useless. Similarly, for this specific use, Git's standard support for PGP signatures is also useless - you can use a 4,096 bit RSA signature, but it only guarantees a 160-bit SHA1 hash, which (given collisions) is not dependable as a proof.

If you really need it, you need something else - use an SHA2 or SHA3 variant on an repeatable export of the database, e.g. using git-evtag [1] (not my project; Note: I haven't audited it, and I don't consider myself a qualified cryptographer - Use at your own peril).

[0] https://sites.google.com/site/itstheshappening/

[1] https://github.com/cgwalters/git-evtag

edit: added wording to make clear I am not the author of git-evtag

detrino2• 11 years ago

Git was not designed for security

Can you elaborate on this? While it's true that SHA-1 is now broken, my understanding is that git's reason for using SHA-1 was to ensure the integrity of the entire history.

beagle32• 11 years ago

The requirement for git was integrity against random bit flips. Linus could have used CRC-160 instead (or any other good hash, e.g. modolu 2^160-x for small x that makes it prime), and get equally good protection against random bit flips, or honest mistakes.

However, Linus used SHA1, which offered two additional properties not strictly needed for the git use case:

1) Preimage resistance - that is, it is considered practically impossible in the next few decades to find an input file with a given hash

2) Collision resistance - that is, to find two different input files with the same hash.

preimage collision means that given a hash for a known repository state in which no file was controlled by an adversary at any point in time, you can be sure that if the hashes match, the content matches.

collision resistance means that given a hash for a known repository state, you can be sure that if the hashes match, the content matches. (Notice that with collision resistance, it is ok even if some files were controlled by an adversary).

When Linus chose SHA1, he got those two features "for free" (almost free - CRC-160 would be slightly faster to compute than SHA-1, but either is negligible in the grand scheme of things). But IIRC he explained several times that he wasn't looking for them. It turns out that collision resistance is probably not a feature of SHA1.

Now, SHA1 is still useful to prove to yourself that nothing was changed provided that none of the files was created by an adversary (no preimage attack known yet). However, for proving the state of a repository to a 3rd party (who may assume you are an adversary), is no longer provided through SHA1.

gwern8• 11 years ago

SHA1 still seems pretty good for most purposes. It would be nice to see if git-evtag would work easily with timestamping.

(As I understand the writeup, it is ultimately just generating a longer/securer hash of the entire tree's contents rather than just SHA1s, and so the post-commit script could be as simple as 'timestamp `git-evtag`', but the compile failed on my system so I am unable to try it out personally.)

Cryptographically timestamping all your Git commits automatically

Related Stories