Private storage

Private and authentic storage. So far, it was assumed that data stored in correct entities is completely private, i.e., an attacker can neither read nor modify it. However, it is sometimes useful to distinguish how much of the data really has to be secret, because private storage is hard to implement in practice — one needs... 

Secret sharing schemes, introduced in [Blak79, Sham79], can be used to approach this situation for private storage, too. However, in this case, several shares must remain intact for the secret to be recovered and must be recollected each time the secret is used. 

MerkSS, G0MR88]. The former leads to shorter signatures, the latter is more flexible. Its basic idea is that new public keys are authenticated using old keys. Fail-stop versions of both are presented in Sections 10.2 and 10.3, respectively. Section 10.4 contains a variant of top-down tree authentication that only needs a small amount of private storage. This may be important in practice, see the end of Section 5.4.1. 

In Section 10.4, additional measures are added so that the amount of private storage is small all the time. Those measures are constructed specifically for the general construction framework from Section 9.2 and thus for the efficient schemes based on factoring and discrete logarithms. 

Top-Down Tree Authentication with Small Amount of Private Storage... 

However, it is now shown that a secret key of this size never needs to exist completely at the same time In the following construction, the signer s entity only needs a small amount of private storage, whereas the rest of its information can be stored in authentic, but not necessarily secret storage. As mentioned in Section 5.4.1, Some Special Properties , this can be an advantage in practice. 

A large amount of private storage is needed in Construction 10.13 because all the values skjempi must be stored secretly so that one-time forgeries at any node of the tree can be proved. The basic idea that will be used to reduce private storage in this construction is to store those sk tempi s that are no longer used for signing in encrypted form (in an authentic way, but not secretly) and to store only the encryption key secretly. The idea is shown in Figure 10.3. 

Figure 10.3. Top-down tree authentication with small amount of private storage.

Values skjtemp are abbreviated as sk. The figure shows the situation after three real messages have been signed. Only the encircled values have to be in private storage. Values crossed out have been deleted. The remaining values are in authentic storage, where authi is the information stored in authentic storage instead of ski, i.e., (mi, si, in Construction 10.19. 

The intuitive meaning is that skjempj>riv is stored in private storage, whereas skjemp auth is in authentic, but not necessarily secret storage. 

The corresponding standard fail-stop signature scheme with top-down tree authentication and a small amount of private storage (with prekey and with a distinction between private and authentic storage) is constructed by using the given one-time scheme in top-down tree authentication (Construction 10.13) with the following modifications ... 

Hence, if this construction is applied to a binary complete tree, as assumed above, the amount of private storage needed is only logarithmic in the message bound, N. ... 

The abbreviated names of the constructions mean bottom-up tree authentication (10.9), top-down tree authentication (10.13), top-down tree authentication with a small amount of private storage (10.19), the discrete-logarithm scheme with minimized secret key (10.22) without combination with tree authentication, and the construction with a list-shaped tree for a fixed recipient from Section 10.6. The first column of lower bounds is for standard fail-stop signature schemes (Sections 11.3 and 11.4), the second one for standard information-theoretically secure signature schemes (Section 11.5) here the length of a test key has been entered in the row with the public keys. 

Recall from Remark 10.24 that a scheihe exists where the key length and the private storage are the same as in Construction 10.22 and the signature length is only Ik, but that it has disadvantages in other respects and log2(A0 must be dominated by k in these schemes anyway. 

The informatics process requires the integration and analysis of datasets in the public domain as well as from proprietary data sources that represent the intellectual property of the research organization. Public flat-file biology data are often curated and delivered from a number of public ftp sites. This information is released periodically, and any private storage of this information must be kept up to date with the public data as they are released. In addition, these data may be available in a variety of physical formats, such as flat file, Extensible Markup Language (XML), and relational. Software systems must support the ability to keep proprietary information physically separate to facilitate both the periodic update of public data and the integrity and security of private intellectual property. 

Superior water supplies comprise town mains, automatic pump supply, elevated private storage, gravity tank, pressure tank. 

---