calybris1.3.0What was checked, and by whose word
Each line is a separate check. They are not equally strong: the operator's own signature proves nothing about honesty, and the witness here is run by the maintainer.
Try to break it
Pick an attack on the real log. Each time, your browser re-checks all 1,000 decisions against the signed checkpoint. Nothing leaves this tab.
Checking the log…
The summary above follows along: its last line turns red while the log is edited.
Would an ordinary log catch it?
The same attacks against three ways of keeping a decision record. The first three rows are what you just tried; the rest are the operator cheating on its own record.
| Attack | Database log | Signed hash chain | Calybris 1.3 |
|---|---|---|---|
| Change a past decision | ✗ | ✓ | ✓ |
| Delete or reorder decisions | ✗ | ✓ | ✓ |
| Cut the latest decisions | ✗ | ✗ | ✓ signed checkpoint |
| Quietly change the rules | ✗ | ✗ | ✓ rules' fingerprint in every record |
| Rewrite the whole log and sign it again | ✗ | ✗ | ✓ witness, timestamp, Bitcoin |
| Backdate the record | ✗ | ✗ | ✓ RFC 3161, Bitcoin |
| Show two auditors two different logs | ✗ | ✗ | ✓ witness |
A signature and a hash chain catch changes made by someone else. Protection against the operator itself comes from outside parties: a witness that remembers every checkpoint it signed, a timestamping authority and Bitcoin. The timestamping authority and Bitcoin are independent of Calybris already. The witness on this demo log is run by the maintainer, so the last row shows the mechanism, not yet an independent guarantee.
The checkpoint
Three lines say everything about the log: its name, how many decisions it holds, and the Merkle root of all of them. Change any past decision and the root changes.
Who signed it
The log signs its own checkpoint. A witness signs it too, but only after checking that it extends every checkpoint the witness signed before, so a log cannot show two histories to two witnesses.
When it existed
Two parties that have nothing to do with Calybris dated the signed checkpoint: a timestamping authority, and the Bitcoin blockchain. Neither can be backdated by the operator.
The 1,000 decisions
Your browser downloads the whole decision log, checks that each record hashes the one before it, and recomputes the Merkle root. Then pick one decision and check it alone, with ten hashes.
Check it without Calybris
Everything on this page is in one bundle. The commands below use OpenSSL, OpenTimestamps and a Python script written from the specifications with no Calybris code in it.
python3 verify_bundle.py .
openssl ts -verify -data 000001.checkpoint.signed -in 000001.checkpoint.signed.tsr \
-CAfile freetsa-ca.crt -untrusted freetsa-tsa.crt
# Bitcoin: drop 000001.checkpoint.signed.ots and 000001.checkpoint.signed
# on https://opentimestamps.org, or: ots verify 000001.checkpoint.signed.ots
The files one by one are in /verify/bundle/, with VERIFY.md explaining each.
What this does not show
- That the witness is independent. It is run by the maintainer, and shows the mechanism, not a second party's word. Independent witnesses are organisations that are not Calybris; none cosigns this log yet.
- That the Bitcoin block is on the main chain beyond what two public explorers agree on. For certainty, compare the block hash with your own Bitcoin node.
- That the decisions were right. It shows which decisions were written, and that they existed by the stated time.