Re: SAVxxx TAPES: undoubtfully identifying NOT-local origin (e.g. jury Court room)

On Fri, Apr 16, 2010 at 17:49, Antonio Fernandez-Vicenti
<afvaiv@xxxxxxxxxxxxxx> wrote:

and something so "basic" as to identify the System's SYSNAME /
MachineSerialNo when you do a SAVxxx is not kept anywhere!!!

The serial number is saved on the tape. Do a DSPTAP TAP01
data(*savrst), Press F16, Page Down.

It's just that this information isn't of any use, since it's just a
value, without a signature, that could be modified trivially by anyone
with an LTO4 drive and a programmer that knows what he's doing.

As mentioned, we shall reconsider checksum, hash, php, ... but this
should be "in addition to"...

A signed checksum is the way to go if you need to be sure - or
alternatively encryption. You will also need to securely store the key
for signing, and make sure you have the public key in writing for
further verification. You'll also need to regularly change this key,
because it could be compromised.

Making sure is hard to do. It's not a cake walk. IBM provides all the
tools you need for full tape encryption. But you need to use them, if
you need to be "undoubtfully" sure. Or, if that's too expensive, you
need to write your own checksum/signing mechanism, preferably using
industry standards such as SHA1 checksums and PGP signatures.