Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Does there currently exist a free online service that accepts a file, hashes it, takes an authoritatively chosen timestamp (from one or more time services), signs these and sends this signed message back? E.g. a digital notary, but only with regards to the timestamp and not the validity of the content as legal notaries might be obligated to guarantee.

Such a service might have an extremely simple API: Simply wget http://service/<checksum> and receive a signed message containing one or more timestamps and the checksum. The emphasis would be on the type of authority who might make such a service.

share|improve this question
    
Not exactly helpful, but you can try to stack type 0x40 PGP signature packets together in one PGP key. Problem is, I don't know of any implementation that creates type 0x40 keys. –  calccrypto Dec 29 '13 at 21:50
1  
This service is a pretty popular one and has been up for a long time. It's not an "instant" API though, it uses emails and it seems to send your stamp at the end of the day. –  orlp Dec 30 '13 at 1:23
    
I ended up reasking this at: softwarerecs.stackexchange.com/questions/14139/… because I hadn't found it before. –  Ciro Santilli Nov 24 at 10:39

2 Answers 2

up vote 7 down vote accepted

If you search on "timestamp", "timestamping", and "notary" on Crypto.SE and Security.SE, you'll find lots of references. I've collected a number of timestamping services that were mentioned in one of those places; this should provide a number of companies and online services you can check out:

I cannot vouch for or endorse any of those.

See, for instance, the following questions on this site, and the following other resources:

Happy reading!

share|improve this answer

Several certificate authorities operate RFC-3161-compliant time-stamp servers that can be used free-of-charge. OpenSSL can create RFC 3161 time-stamp requests and verify the responses.

Here is a simple Bash script that time-stamps a file using the time-stamp server operated by StartSSL:

in_file='[path to file]'  # name of file to be hashed and time-stamped
out_file="${in_file}.tsr"  # name of file to save the time-stamp response
ts_server='http://www.startssl.com/timestamp'  # URL of time-stamp server

# Use openssl to create the time-stamp request, then use curl to submit the request and save the response.
openssl ts -query -data "$in_file" -sha1 -cert |
curl -o "$out_file" -sSH 'Content-Type: application/timestamp-query' --data-binary @- "$ts_server"

# Verify the response.
openssl ts -verify -data "$in_file" -in "$out_file" -CApath "$(openssl version -d | cut -d '"' -f 2)/certs/"

# Print the response in human-readable format for more info.
openssl ts -reply -in "$out_file" -text

Example of command outputs:

$ echo 'This is an example.' > testfile

$ in_file='./testfile'
$ out_file="${in_file}.tsr"
$ ts_server='http://www.startssl.com/timestamp'

$ openssl ts -query -data "$in_file" -sha1 -cert |
> curl -o "$out_file" -sSH 'Content-Type: application/timestamp-query' --data-binary @- "$ts_server"

$ openssl ts -verify -data "$in_file" -in "$out_file" -CApath "$(openssl version -d | cut -d '"' -f 2)/certs/"
Verification: OK

$ openssl ts -reply -in "$out_file" -text
Status info:
Status: Granted.
Status description: unspecified
Failure info: unspecified

TST info:
Version: 1
Policy OID: 1.3.6.1.4.1.23223.1.2.0
Hash Algorithm: sha1
Message data:
    0000 - a6 f1 53 80 1c 93 03 d7-3c a2 b4 3d 3b e6 2f 44   ..S.....<..=;./D
    0010 - c6 b6 64 76                                       ..dv
Serial number: 0x28DD7D
Time stamp: Jan  1 18:26:50 2014 GMT
Accuracy: 0x01 seconds, unspecified millis, unspecified micros
Ordering: no
Nonce: 0xB9943DF6F7CD5191
TSA: DirName:/CN=StartCom Time-Stamping Authority/O=StartCom Ltd. (Start Commercial Limited)
Extensions:

Given a copy of the original file along with the *.tsr response, anyone can verify that the authority time-stamped the hash of the file at the specified time.

On Windows, Microsoft's SignTool can be used instead of OpenSSL.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.