It is common today in large corporate environments for system administrators to employ centralized systems for log collection and analysis. The log data can come from any device between smart-phones and large scale server clusters. During an investigation of a system failure or suspected intrusion these logs may contain vital information. However, the trustworthiness of this log data must be confirmed. The objective of this thesis is to evaluate the state of the art and provide practical solutions and suggestions in the field of secure logging. In this thesis we focus on solutions that do not require a persistent connection to a central log management system. To this end a prototype logging framework was developed including client, server and verification applications. The client employs different techniques of signing log entries. The focus of this thesis is to evaluate each signing technique from both a security and performance perspective. This thesis evaluates "Traditional RSA-signing", "Traditional Hash-chains"', "Itkis-Reyzin's asymmetric FSS scheme" and "RSA signing and tick-stamping with TPM", the latter being a novel technique developed by us. In our evaluations we recognized the inability of the evaluated techniques to detect so called `truncation-attacks', therefore a truncation detection module was also developed which can be used independent of and side-by-side with any signing technique. In this thesis we conclude that our novel Trusted Platform Module technique has the most to offer in terms of log security, however it does introduce a hardware dependency on the TPM. We have also shown that the truncation detection technique can be used to assure an external verifier of the number of log entries that has at least passed through the log client software.

A digital signature technique has evolved into varies digital signature schemes in different application environments. In general, a digital signature consists of a random number and a hash function in addition to signing function. The random number can be used to provide the randomization of digital signatures. The hash function can be used for generating a message digest that has a fix length and is convenient for signing. The random number that hides in the digital signature is a useful factor. If we can use this factor well, then the digital signature can carry the other secret messages. On the basis of the concept of a subliminal channel proposed by Simmon, we have proposed multiple subliminal channels that can carry more than one subliminal message to different subliminal receivers. Furthermore, by using the concept of a subliminal channel, we can use the random number as another secure parameter of the digital signature. This concept leads to a forward-secure digital signature with backward-secure detection when the subliminal channel is embedded in the signature. We have proposed a forward-backward secure digital signature. A hash function is an important tool for generating a message digest. The hash function used in a signature must be one-way and collision resistant. A signing message will map to a message digest via a hash function. In recent years, several chameleon hash functions have been proposed. A chameleon hash function is a trapdoor one-way hash function that prevents everyone except the holder of the trapdoor key from computing the collisions for a randomly given input. There are various studies that apply the chameleon hash function to online/offline digital signatures and sterilization signatures. In this thesis, we apply this concept to a network secure gateway. We have achieved fast blind verification for an application gateway, such as a firewall. Further, we propose triple-trapdoor chameleon hash function and apply to vehicle owenship identification scheme. We have achieved the fast identification for vehicle ownership without connect to online database. We also have proposed threshold chameleon hash function and achieved that the collision will control under the threshold value. The trapdoor information will be exposed after the number of collision has accomplished.