ImageMaster Evidence Tree Signature (long term preservation in hash tree)

In contrast to time-stamping the focus of the hash tree feature is the long term preservation of evidence. Due to the fact that certificates used to sign documents could get compromised, and signing or even hashing algorithms could get weak over time, an approach is needed to handle such situations.

The Evidence Tree Signature achieves the long term preservation of evidence by storing the hashes of content in so called Merkle hash trees. In a Merkle hash tree the hash values are stored in hierarchies. On the lowest level are the hashes calculated of the content objects themselves. They are concatenated in pairs and hash values of those concatenations are calculated and stored in the next hierarchy level and so on up to the top. Finally, a timestamp of the top hash is created so the hashes of all content objects below are secured with only one timestamp.

The contents are not directly stored in the tree but first put in a queue. After a configured period of time or when a predefined number of content items is reached, the hash tree is created like described before.

A verification of a signature is supported along with the long term preservation in hash tree functionality.

Resigning of the tree

If a timestamp certificate is compromised or the used signing algorithm is about to get weak in the near future it’s possible to create an additional timestamp of the existing one using a new certificate and current signing algorithm. With this approach the complete tree is regarded as resigned. This is a great advantage in contrast to an approach where each content is resigned separately.

However, if the algorithm used to create the hash values of the content is about to get weak, all content objects have to be rehashed again and new hash trees have to be built. Fortunately, this happens much less often than the first case.

Both functionalities can be triggered in the administration interface of the ArchiSig-Module, which is available as a separate interface in addition to the ImageMaster Client.

To get the evidence of a stored content item, a so called evidence record can be calculated and retrieved on demand. Evidence records are not permanently stored as archived objects in ImageMaster, but the evidence is rather represented in the stored hash tree in the database.

The following sources provide further background information:

Evidence Record import into hash trees

Any valid Evidence Record (as defined in [RFC 4998]) can be imported into an ImageMaster hash tree. Future Evidence Records produced for the data object from such a hash tree will include the contents of the original Evidence Record linked to any later added timestamps via hash tree renewal. So the entire history of the object can be verified and proved with a single Evidence Record. See Evidence Record import for more details.