Firmaprofesional: 2023 - Ensure Timestamp service Logs Integrity
Firmaprofesional reported a finding from its annual eIDAS/ETSI audit regarding the integrity of timestamp service logs. During the audit, the auditors noted that while access to the timestamp service logs is restricted to authorized trusted roles, no measure was identified to guarantee the integrity of the generated logs. Firmaprofesional analyzed the finding and determined the existing access control was insufficient for the requirement to guarantee log integrity. On 2023-05-09, Firmaprofesional decided to use the timestamp of the TSA service logs and began sealing the time-stamping service logs with TSA. The bug was marked FIXED, and the reporter asked for closure after the fix was completed on May 9th. Mozilla indicated it would close the bug on June 7th unless there were objections.
- During the annual eIDAS/ETSI audit, auditors notified Firmaprofesional of a finding about the lack of a measure to guarantee timestamp service log integrity.
- Firmaprofesional decided to use TSA timestamps for the TSA service logs and began sealing the time-stamping service logs with TSA.
- The reporter requested closure after the fix was completed on May 9th, and Mozilla scheduled closure for June 7th unless objections were raised.
- Autoridad de Certificacion Firmaprofesional — Created the bug describing the audit finding and stated that on 2023-05-09 Firmaprofesional decided to seal timestamp service logs with TSA (LogsTSA.zip attached).
- Autoridad de Certificacion Firmaprofesional — Asked that the bug be closed because it was fixed immediately on May 9th.
- Mozilla representative — Agreed to close the bug on Wed. June 7th unless there were objections.