Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • The goal is to prove the authenticity within reason, to the extend generally required by a system of law. I think the only question that I have about your answer is "Wouldn't someone else need to hold the keys?" Commented Jun 11, 2014 at 23:47
  • Because if I possess the keys, it seems that it's my word alone authenticating the documents. +1 for secure storage though. Commented Jun 11, 2014 at 23:48
  • Generally, if you keep the keys in another secure data store, then that's good enough. But, like I say, someone with root access can unravel the whole thing -- because the application itself needs to be able to read and write those documents. So that opens up the broader problem of securing your servers, network, and databases. But that's kind of a well-known problem, and boils down to protecting PII (Personally Identifiable Information) and PCI (basically credit card information). Commented Jun 11, 2014 at 23:51
  • The issue becomes "now how can I protect this system from myself?" (Protection from root access is important in order to ensure that the system is self sustaining). Otherwise, "an average guy like me" can't do it. I'd need to involve a third party. Commented Jun 11, 2014 at 23:54