如何对日志进行数字签名以确保它们未被修改？

Question

In our application logs must be signed in order to prove that they have not been changed after they happened.

This means that they must be signed using some sort of timestamp that links the signature with the time at which the log was written and signed.

This way the log cannot be modified and signed again without changing that timestamp -and therefore any modification attempt could be detected-.

Is there a standard way to do this?

Answer 1

Eugene Mayevski is right, CAdES signature timestamped with the use of external timestamping service will do the job. However, everything depends on the exact threats to the logs your application creates and their potential originators. In the first approximation, signing a hash of the log with an external TSA (without local CAdES signing) would be enough for you.

Answer 2

Timestamping is part of CAdES standard, and this standard allows detached signatures. So yes, you can use digital signing with timestamping. The problem of altering the signed data or misusing the private key (stored in your application) is addressed by timestamping quite efficiently.

If you develop a .NET or Windows application, you can use PKIBlackbox package of our SecureBlackbox product to make CAdES signatures with timestamping.