[Paper Review] Authenticated Append-only Skip Lists

Petros Maniatis, Mary Baker|ArXiv.org|Feb 7, 2003

Cloud Data Security Solutions8 references13 citations

TL;DR

This paper introduces the Authenticated Append-Only Skip List (AASL), a cryptographically secure data structure that enables tamper-evident, append-only logging in distributed systems. It allows maintainers to commit to a sequence via a succinct digest and generate compact proofs for any element’s membership and position, ensuring provable integrity even against malicious maintainers who cannot forge entries or provide conflicting proofs.

ABSTRACT

In this work we describe, design and analyze the security of a tamper-evident, append-only data structure for maintaining secure data sequences in a loosely coupled distributed system where individual system components may be mutually distrustful. The resulting data structure, called an Authenticated Append-Only Skip List (AASL), allows its maintainers to produce one-way digests of the entire data sequence, which they can publish to others as a commitment on the contents and order of the sequence. The maintainer can produce efficiently succinct proofs that authenticate a particular datum in a particular position of the data sequence against a published digest. AASLs are secure against tampering even by malicious data structure maintainers. First, we show that a maintainer cannot ``invent'' and authenticate data elements for the AASL after he has committed to the structure. Second, he cannot equivocate by being able to prove conflicting facts about a particular position of the data sequence. This is the case even when the data sequence grows with time and its maintainer publishes successive commitments at times of his own choosing. AASLs can be invaluable in reasoning about the integrity of system logs maintained by untrusted components of a loosely-coupled distributed system.

Motivation & Objective

• To address the challenge of maintaining trustworthy, tamper-evident system logs in loosely-coupled, mutually distrustful distributed systems where no central authority can be trusted.
• To design a scalable data structure that supports efficient, cryptographically verifiable membership proofs for any element in a sequence, even after long periods of growth.
• To ensure that a malicious maintainer cannot forge new entries or produce conflicting proofs about the same position in the sequence, preserving consistency and integrity.
• To provide a mechanism for remote components to verify the authenticity and order of log entries using only a published digest and a succinct proof, without trusting the data source.

Proposed method

• The AASL uses a hierarchical skip list structure where each node contains a data element and a cryptographic authenticator computed via a commutative hash function.
• Each level of the skip list is protected by a hash chain, with authenticators propagated upward to form a compact digest representing the entire sequence.
• Membership proofs are constructed by traversing the skip list from the root to the target element, collecting only the necessary nodes and authenticators to verify the element’s presence and position.
• Advancement proofs are used to verify the consistency of the sequence over time, ensuring that a digest published at one time cannot be contradicted by a later proof.
• Cryptographic security is enforced through the use of collision-resistant hash functions and a proof system that prevents equivocation by requiring all verification paths to agree on intermediate authenticator values.
• The construction ensures that any attempt to alter, reorder, or insert data after a digest is published will be detected by verification algorithms, as it breaks the consistency of authenticator chains.

Experimental results

Research questions

• RQ1 Can a cryptographically secure, append-only data structure be designed that allows efficient, succinct proofs of membership and position, even for very long sequences?
• RQ2 Can such a structure prevent a malicious maintainer from forging new entries or producing conflicting proofs about the same sequence position?
• RQ3 Can the structure support multiple, independently verifiable commitments over time, ensuring that later digests are consistent with earlier ones?
• RQ4 Is it possible to achieve logarithmic-sized proofs and efficient verification while maintaining strong security guarantees against tampering, even by the structure’s own maintainer?

Key findings

• The AASL construction provides a one-way digest that commits to the entire sequence’s contents and order, enabling remote parties to verify the integrity of any data element using a succinct proof.
• The structure guarantees that a malicious maintainer cannot produce a valid proof for a data element that was not actually appended to the sequence after the digest was published.
• The system prevents equivocation: a maintainer cannot generate two valid proofs for the same position that contradict each other, even across different time points or digest commitments.
• The proof system ensures that all verification paths—membership, advancement, and digest verification—must agree on intermediate authenticator values, preventing consistency attacks.
• The security model holds even when the sequence grows indefinitely and the maintainer publishes digests at arbitrary times, preserving auditability over long periods.
• Performance measurements show that AASLs support efficient proof generation and verification with logarithmic proof size relative to sequence length, making them practical for large-scale systems.