Re: Time Stamping a Program in Ada-95

[Austin Obyrne <austin.obyrne@hotmail.com>]

On Thursday, September 13, 2012 8:56:57 PM UTC+1, Ludovic Brenta wrote:
> Austin Obyrne writes: > Time Stamping a Program in Ada-95 > > If I ‘compile to listing’ using the “Run – Compile to Listing” > facility in Ada-95 Ada 95 has no such facility; you must be talking about one particular implementation (i.e. compiler and presumably IDE) of Ada 95. > I can get a time stamp declaration of the day and exact time instant > of that compiling that is very useful in a court of law later as > documentary evidence but if I subsequently compile as usual later on > i.e. just by clicking on the ‘compile’ button in the toolbar of my > editor it overwrites that earlier time stamp – I think. Since you're a serious cryptologist, you must know how easy it is to fake a timestamp. Many 13-year-old attackers can edit the binary file emitted by your compiler and change the timestamp, replace your name from the copyright notice, insert a rootkit in your executable and take control of your computer from their bedroom. Unless, of course, you take the precaution of digitally signing your executables, exerting proper access control and checking the signature every time you change them (i.e. by running Debian :) ). > Lemme explain a bit better. When I complete a piece of development > work that evolves as a piece of software I will want to secure the > copyright. Although there are many ways of doing this the way I > favour most is the intrinsic time stamp method i.e. if I compile to > listing I will get a print-out of the compiler number and the exact > time and day on which it was last compiled. This is powerful evidence > of copyright. No. The proper way is to write your precious copyrighted work on a CD-ROM and ask a notary or bailiff to keep it in a safe. It is their job to testify in court what day you provided your CD-ROM. > I want to try and prevent that happening accidentally. No. You want to prevent that happening because a malicious attacker makes a conscious effort to steal your copyrighted work, and has knowledge and means to that end. Much more difficult. As for accidental changes, just make your executables read-only or use a copy-on-write filesystem, or use a proper version control system. > Does anybody know more about this – is it possible to do both without > losing the time stamp facility i.e. compile to listing and ordinary > periodic compiling from the tool bar also? Sure, I do it all the time. I use monotone and I sign my Debian packages with a trusted GPG key. > If this is not possible to prevent it should be brought to the notice > of the powers that be in Ada as a useful security function going > begging ?? It is possible. With or without Ada or any compiler. What I said applies also to plain text files containing poetry, if you want. -- Ludovic Brenta.

Many thanks for your advice.  I'm surprised that this might be an attribute of just one particlar editor and not a general thing in many editors. 

In passing, this has no security function - it is just a case of belt and braces proof of the origin of the source code.

In practice I would probably post a copy to myself with recorded delivery and not open it when I receive it back.

Thanks - adacrypt