如何对日志进行数字签名以确保它们未被修改？
在我们的应用程序中，日志必须进行签名，以证明它们在发生后没有被更改。
这意味着必须使用某种时间戳对它们进行签名，该时间戳将签名与日志写入和签名的时间链接起来。
这样，在不更改时间戳的情况下，无法再次修改日志并对其进行签名 - 因此可以检测到任何修改尝试。
有没有标准的方法来做到这一点？
In our application logs must be signed in order to prove that they have not been changed after they happened.
This means that they must be signed using some sort of timestamp that links the signature with the time at which the log was written and signed.
This way the log cannot be modified and signed again without changing that timestamp -and therefore any modification attempt could be detected-.
Is there a standard way to do this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
Eugene Mayevski 是对的，使用外部时间戳服务加上 CAdES 签名时间戳即可完成这项工作。然而，一切都取决于您的应用程序创建的日志的确切威胁及其潜在的发起者。在第一个近似中，使用外部 TSA 对日志的哈希进行签名（无需本地 CAdES 签名）就足够了。
Eugene Mayevski is right, CAdES signature timestamped with the use of external timestamping service will do the job. However, everything depends on the exact threats to the logs your application creates and their potential originators. In the first approximation, signing a hash of the log with an external TSA (without local CAdES signing) would be enough for you.
时间戳是 CAdES 标准的一部分，该标准允许分离签名。所以是的，您可以使用带时间戳的数字签名。通过时间戳可以非常有效地解决更改签名数据或滥用私钥（存储在应用程序中）的问题。
如果您开发 .NET 或 Windows 应用程序，您可以使用我们的 SecureBlackbox 用于制作带时间戳的 CAdES 签名的产品。
Timestamping is part of CAdES standard, and this standard allows detached signatures. So yes, you can use digital signing with timestamping. The problem of altering the signed data or misusing the private key (stored in your application) is addressed by timestamping quite efficiently.
If you develop a .NET or Windows application, you can use PKIBlackbox package of our SecureBlackbox product to make CAdES signatures with timestamping.