Practical Secure Logging: Seekable Sequential Key Generators

Abstract

Abstract. In computer forensics, log files are indispensable resources that support auditors in identifying and understanding system threats and security breaches. If such logs are recorded locally, i.e., stored on the monitored machine itself, the problem of log authentication arises: if a system intrusion takes place, the intruder might be able to manipulate the log entries and cover her traces. Mechanisms that cryptographically protect collected log messages from manipulation should ideally have two properties: they should be forward-secure (the adversary gets no advantage from learning current keys when aiming at forging past log entries), and they should be seekable (the auditor can verify the integrity of log entries in any order or access pattern, at virtually no computational cost). We propose a new cryptographic primitive, a seekable sequential key generator (SSKG), that combines these two properties and has direct application in secure logging. We rigorously formalize the required security properties and give a provably-secure construction based on the integer factorization problem. We further optimize the scheme in various ways, preparing it for real-world deployment. As a byproduct, we develop the notion of a shortcut one-way permutation (SCP), which might be of independent interest. Our work is highly relevant in practice. Indeed, our SSKG implementation has become part of the logging service of the systemd system manager, a core component of many modern commercial Linux-based operating systems.

Even More Practical Secure Logging: Tree-Based Seekable Sequential Key Generators

“…In contrast to the prior SSKG from [16], our scheme relies on just symmetric building blocks; in particular we propose instantiations that exclusively use either PRGs, block ciphers, or hash functions. By consequence, our implementation beats the one from [16] by 1-3 orders of magnitude, on current CPUs. In addition to this efficiency gain, we also identify new and appealing functionality features of our SSKG.…”

“…Although hash chains, in principle, lead to (forward-)secure local logging, they also come with an efficiency penalty on the side of the log auditor: the latter, in order to verify a log record of a certain epoch t, first needs to recover the corresponding key K t ; however, as a high level of security requires a high key update rate, this might involve millions of hash function evaluations. This problem was addressed only recently: in [16], efficient forward-secure local logging is achieved via a seekable sequential key generator (SSKG).…”

“…We give a rough overview over the ideas in [16]. Essentially, the authors propose a generic construction of an SSKG from a shortcut one-way permutation (SCP), a primitive that implements a one-way permutation π : D → D, for a domain D, with a dedicated shortcut algorithm allowing the computation of the k-fold composition π k in sublinear time.…”

“…Essentially, the authors propose a generic construction of an SSKG from a shortcut one-way permutation (SCP), a primitive that implements a one-way permutation π : D → D, for a domain D, with a dedicated shortcut algorithm allowing the computation of the k-fold composition π k in sublinear time. The concrete SCP considered in [16] is given by the squaring operation modulo a Blum integer N , where applying the shortcut corresponds to reducing a certain exponent modulo ϕ(N ). Given an SCP, an SSKG can be obtained by letting its state consist of a single element in D, performing state updates by applying π to this element, and deriving keys by hashing it (more precisely, by applying a random oracle).…”

“…While it is instructive to observe how the forward security of the SSKG corresponds with the one-wayness of the SCP, and how its seekability is based on the SCP's shortcut property, a notable technical artifact of the squaring-based SCP is that seekability requires knowledge of ϕ(N ) while forward security requires this value to be unknown. This dilemma is side-stepped in [16] by giving only the owners of a seeking key the ability to fast-forward through the SSKG output sequence.…”