Problem
Given any piece of data, I could sign it with public key and made available online. This proves I am in possession of given data, but it doesn't tell I am the creator. The only possibility (I'm aware of) to prove this, is to prove, that I was chronologically first to have it.
Simple approach.
Lets assume, that I wrote piece of code, and I want to generate some proof, that I am legitimate author of it. I can simply sign it's hash with e.g. RSA and put the signature along source code to some trusted site, like github. Now my commit has timestamp generated with this trusted site, and even if some Alice would sign herself the same source code, her upload to any trusted site will have newer timestamp proving she's not the legitimate author. This works as long as we'd assume data on github has undetermined life span and will be always available which is hardly true about any server out there. When that commit would be lost, my rights to the source code are lost as well: I might still have my local signed copy, but I cannot prove I've created it at given time.
My understanding of the problem.
I believe there is no possibility to self-authenticate, that I were in possession of given data at specific time - I could just made up arbitrary timestamp and sign it. Moreover, anyone out there could get my publicly available data, replace personal data with their, made up older timestamp and call me thief. Thus, sign from trusted server is needed.
Trusted timestamp
My idea of the mechanism is as follow: sign source code, optionally append personal data, generate hash and send this hash to trusted server. Then this server would have to send me back signed information, that it received hash H at time T. This way I've got publicly accepted certificate, that I've got file with hash H at time T. Even if the server had go down, I would still have the certificate.
Question
So is the "trusted timestamp" good solution to the legitimate author problem? Do you know of any available open source tools to achieve this goal? Maybe other techniques? Assuming, I want to public code/publication/anything else licensed for non-commercial use only, should I be concerned with such issues?
