[490] in Intrusion Detection Systems
Re: Timestamping
daemon@ATHENA.MIT.EDU (Chris Dunlap)
Fri Jan 26 15:23:18 1996
Date: Thu, 25 Jan 1996 09:28:21 -0600
To: ids@uow.edu.au
From: dun@ncsa.uiuc.edu (Chris Dunlap)
Reply-To: ids@uow.edu.au
It was on 1/22/96 at 8:41 AM when Doug Hughes wrote:
>The best way to do this is with digital signatures. If you include the
>timestamp in the body of the message, and then sign the body of the message,
>there can be no doubt about the time (unless you have a weak key-length, or
>your key has been compromised). PGP/PEM will do this.
There can be no doubt. Use the largest key you can.
How do you prove the timestamp in the body of the message is the
correct time in the first place? Your system clock could have been
set forward or back before your digital signature. The whole point
behind using a timestamping service is that their clock is supposedly
secure (and somewhere outside of your control).
--
Chris Dunlap <*>
dun@ncsa.uiuc.edu
