Subject: [Internetgovtech] Things for governments to do

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 12 Nov 2013 15:03:19 -0800

One of the big challenges in managing lots of volunteers is that everyone
wants to do the tasks that they know about which are typically the tasks
that are already being done.

A role that many governments could usefully contribute is to provide
reference cryptographic services analogous to the reference time services
that many weights and measures organizations already provide (e.g.
Greenwich observatory, NIST, etc.).

There is a need for trustworthy timestamps in a wide number of protocols.
While commercial notaries can provide this service at a technical level,
the legal validity of such services might be expensive to prove in court.
Having a national reference assures users that there is some level of
government recognition of the status of the service.

A national cryptographic bureau would play an analogous role to the weights
and measures bureaus and provide reference services against which
commercial providers would benchmark their offerings from time to time. It
would not be necessary for every country to operate such a bureau just as
it is not necessary for every country to provide reference weights and
measures. As with weights and measures based on physical objects there is a
value to having multiple reference labs but unlike with physical objects
there is no penalty for having a large number.

As with weights and measures, the primary consumers of the services would
be commercial providers who would in turn provide services to other
businesses. Governments could of course operate a direct service but that
would entail the usual commercial risks, overheads and constraints.

I don't see CA certificate services as being among the services that would
be provided except where the government is already providing those
functions. Where governments recognize PKI, they recognize particular CAs
for particular purposes and with specific validation requirements. These
are not commodity services suitable for inter-government standardization.
The services I see as being useful are timestamp authority services, and
pre-committed unpredictable sources. These are or at least can be provided
on a commodity basis.

A timestamp authority produces a chain of hash values where each successive
hash value is computed from the previous hash value and inputs from one or
more external sources. For a national notary the sources would be
commercial notaries (and potentially peer national notaries).

A pre-committed unpredictable source is formed by choosing a random seed s
and a hash function H(x) and computing H(...H(s)) to a very large power.
The provider releases H^n(s) at the start, H^n-1(s) on the next 'tick',
H^n-2(s) on the next and so on.

All the outputs of the authority are digitally signed.

Combining the two functions allows a notarized document to be fixed in time
with near absolute certainty. This is of great benefit in fixing evidence
in actual and potential lawsuits. For example, data recorded on digital
cameras, etc. may be fixed and the time at which it is fixed put beyond
reasonable doubt. Contracts, bids, trades may be fixed with recognized
legal authority.

The last time serious consideration was given to these possibilities was
the mid 1990s when many governments passed forward thinking legislation to
support digital signatures, electronic notaries, etc. Unfortunately much of
this thought proved to be perhaps a little too forward thinking. Just as it
took business 40 years to understand the full potential of containerized
transport, business is only just beginning to realize the full potential of
the Web.

-- 
Website: http://hallambaker.com/