Re: [ltans] Concrete examples of long-term archiving

[Tobias Gondrom <[e-mail]>]

Hi Martin,

in general you can find real life examples when larger organisations are 
dealing with critical documents (that in paper form would be signed and 
often documenting high value issues) for a longer time frame.

For example:
- the German federal government uses ERS for signed data.
There is even a guideline for all German government agencies on how to 
use it:
https://www.bsi.bund.de/ContentBSI/Publikationen/TechnischeRichtlinien/tr03125/index_htm.html
(unfortunately in German, sorry)
* one scenario is for example documents signed in internal workflows and 
documents being delivered to an agency through a so-called agency 
"inbox-system".
- other real life examples are:
* long-term storage of documents, like pension contracts, sorry can't be 
more specific due to confidentiality
* patient records in health care (in some jurisdictions the health care 
provider (e.g. hospital) is responsible to guarantee the integrity and 
authenticity of all archived patient records for the whole lifespan of 
the patient (and to be able to proof that). In the past this was done 
via paper documents, etc. But when such an institution moves/moved to 
electronic records and documents, electronic signatures were used and 
also required ERS to protect against broken algorithms.
* electronic invoices: EU directive on electronic invoices requires them 
to carry a qualified signature to be used for pre-tax allowances. And as 
in some jurisdictions it may take years until the tax auditor validates 
the records, signature algorithms may become weak and require ERS to 
renew their strength.
* or think of blueprints and documentation for air-planes and ammunition 
during their manufacturing process, to be stored for the whole lifetime 
they may be in use.

But to add a pinch of salt: My personal observation is that the vast 
majority of cases of long-term authenticity and proof of existence is 
still using pure simple paper documents stored somewhere physically safe 
in a bunker/paper archive - like we did the last few hundred years....
(Some companies/government agencies have developed the technical 
capabilities to do this electronically with ERS, but most of them 
haven't yet).

Hope that helps, Tobias



On 04/08/11 17:21, Martin Augusto G. Vigil wrote:
> Hi,
>
> I am a PhD student and I have been working on a survey on long-term authenticity and proof of existence. I have found many solutions (e.g. ERS, Patricia Trees, etc), projects (e.g. ArchiSig, Prokopius, HP's Content Integrity Service) and even acts (Sarbanes-Oxley Act, Directive 2001/115/EC) but few real life examples in which long-term archiving is required and was already used.
>
> May someone point some concrete examples?
>
> Kind regards,
> ----
> Martín A. Gagliotti Vigil
> Technische Universität Darmstadt
> Cryptography and Computer Algebra
> Hochschulstraße 10
> 64289 Darmstadt, Germany
> Room: S2/02 B216
> Tel.: [phone]
>
>
>
>
>
> _______________________________________________
> ltans mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ltans