POTSHARDS—a secure, recoverable, long-term archival storage system

TLDR

Users store ever‑growing amounts of digital data, yet encryption‑based security is ill‑suited for indefinite storage because key management is difficult and future cryptanalysis can compromise data. The authors aim to create an archival storage system that secures data for very long lifetimes without relying on encryption. POTSHARDS achieves this by unconditionally splitting secrets, distributing shares across independently managed archives, and using approximate pointers with secure distributed RAID to ensure availability, as demonstrated by a prototype implementation. The system provides long‑term security for data with very long lifetimes without using encryption.

Abstract

Users are storing ever-increasing amounts of information digitally, driven by many factors including government regulations and the public's desire to digitally record their personal histories. Unfortunately, many of the security mechanisms that modern systems rely upon, such as encryption, are poorly suited for storing data for indefinitely long periods of time; it is very difficult to manage keys and update cryptosystems to provide secrecy through encryption over periods of decades. Worse, an adversary who can compromise an archive need only wait for cryptanalysis techniques to catch up to the encryption algorithm used at the time of the compromise in order to obtain “secure” data. To address these concerns, we have developed POTSHARDS, an archival storage system that provides long-term security for data with very long lifetimes without using encryption. Secrecy is achieved by using unconditionally secure secret splitting and spreading the resulting shares across separately managed archives. Providing availability and data recovery in such a system can be difficult; thus, we use a new technique, approximate pointers, in conjunction with secure distributed RAID techniques to provide availability and reliability across independent archives. To validate our design, we developed a prototype POTSHARDS implementation. In addition to providing us with an experimental testbed, this prototype helped us to understand the design issues that must be addressed in order to maximize security.