Tag Info

I didn't try the service of universign, and the description on their web site is not really clear on how it works. So I had a look at RFC 3161, which defines a time stamping protocol. In essence, the service defined there accepts a hash of the message (or document) to be time-stamped, together with some parameters produces a time stamp token. This time ...

Actually Universign produces "Evidence Records" as described by RFC 4998. Evidence Records in turn rely on standard time stamps which RFC 3161 is about. Evidence Records can embed several nested time stamps; this is used for long-term archival, when you want time stamps to remain verifiable beyond the end-of-validity of the certificate of the time stamp ...

You may be interested to check this quite interesting approach to time stamping: http://www.guardtime.com/ It provides KSI (Keyless Signature Infrastructure) for providing proof and non-repudiation of electronic data, using only hash functions for verification. The implementation of KSI is via a globally distributed machine, taking hash values of data as ...

Time stamps are also signatures; see for instance RFC 3161 which is the most commonly used time stamp format. In particular, such time stamps also rely on certificates (the TSA certificate), and thus also expire. So you need regular time stamping; whenever the latest time stamp is about to expire (but before expiration), you need to obtain a new time stamp ...

It would seem that the answer is no. If the TSA's private key is compromised (and thus revoked), the time stamp signature cannot be trusted as whoever compromised it could sign documents with old time stamps. Surely users would want to be warned before accepting a time stamp signature from a compromised certificate. It seems then if this is your threat ...