# Tag Info

21

I would characterize the service as similar to a trusted time-stamping service. Except they do not do the time-stamping, but just provide the "key". This allows a user to decide what do to with it, such as using it as a private key to sign something, or an HMAC key, proving the signature is "not older" than the timestamp. If the signature is published to a ...

12

If you search on "timestamp", "timestamping", and "notary" on Crypto.SE and Security.SE, you'll find lots of references. I've collected a number of timestamping services that were mentioned in one of those places; this should provide a number of companies and online services you can check out: http://www.proofofexistence.com/ https://www.btproof.com/ https:...

10

However, if a nonce can provide all the protection a timestamp does, why would they ever be used together? If you use a timestamp in combination with a nonce, it can help mitigate the risk of nonce reuse. Guaranteeing that nonces are never duplicated within the relevant scope can often make a system more complicated, because it needs to maintain state ...

6

First up: Don't believe the hype! Especially if things can easily be proven wrong. What I mean is that your NIST have just launched a new service… is incorrect, as the NIST Randomness Beacon project is known to me (and others) since 2011. Furthermore, this project was awarded a multi-year grant from NIST's Innovations in Measurement Science (IMS) Program in ...

6

Several certificate authorities operate RFC-3161-compliant time-stamp servers that can be used free-of-charge. OpenSSL can create RFC 3161 time-stamp requests and verify the responses. Here is a simple Bash script that time-stamps a file using the time-stamp server operated by StartSSL: in_file='[path to file]' # name of file to be hashed and time-stamped ...

5

One application for a randomness beacon is to get this assurance. A randomness beacon (NIST runs a prototype one) generates a sequence of public, signed, timestamped random numbers on a fixed schedule. (In NIST's case, it's once per minute.) The beacon operator is promising that the number won't be known to anyone (outside the machine on which the ...

4

Your problem is a tricky one to solve that has been discussed over a period of decades. Tierion (disclosure, where I am VP Engineering), provides a solution for at least part of your problem with our Chainpoint proof services. Chainpoint will soon cryptographically embed the minute-by-minute random values provided by the NIST Randomness Beacon into every ...

4

I don't think there is a pure-cryptography solution to this. Suppose you built a chip, and it time-stamped whatever message you wanted, using an internal atomic clock. For the sake of argument, let's say that it's unhackable, and totally tamper-proof. Well, there's still a loophole. Put the chip on a spacecraft and speed it up to 99% the speed of light for ...

4

Actually, I guess that you are talking about digital signatures and not about public key encryption (since you want to have message authenticity and not confidentiality). Whether using time-stamps or not makes sense depends on your application. Basically, the idea is that the verifier can determine when the signature has been issued and in particular that ...

4

Kerberos requires synchronised clocks mainly to ensure the messages are fresh and to thwart replay attacks. The messages include timestamps so that those with outdated timestamps (e.g. more than 5 minutes) will be thrown away (although there is still a time window in which replay is possible). Many key exchange protocols don't use timestamps because clock ...

3

I wonder why anyone would choose to rely on a source of true random numbers fraught with questions that will ultimately have no provable – or perhaps even satisfactory – answer. There are at least a couple of companies that sell generators that provide high quality true random numbers. Having a generator on-site and available in real-time allows the ...

3

You can prove that a document was signed after a certain date by including data that was not known to anyone before that date, such as stock market data. You cannot prove that a document was signed before a certain date by purely cryptographic means. Information doesn't go stale, so when you show a signature, it could have been signed at any time. You can ...

3

Updated answer: No, this is not possible with cryptography. You have the ciphertext and you have the key. For all anyone knows, you could have made a copy of those to some other computer and decrypted the ciphertext without telling anyone. There's no way (with cryptography) to prove you haven't done that. One approach would be to implement a secure service ...

3

In 1991, Stuart Haber and Scott Stornetta proposed a method for time stamping a digital document. In their method, when someone (Alice) wants to timestamp a document, she send the hash of her document to a Trusted Third Party (TTP). TTP (similar to figure 1) puts this hash in a Merkle tree and sends back to Alice a proof that her document is in the Merkle ...

2

A cryptographically secure Lamport clock (perhaps done using homomorphic encryption) would have a lot of the same properties though, and doesn't require a trusted timesource.

2

Timestamps allow the recipients to know the order in which messages from an honest party were sent. This is sometimes important in cryptographic protocols. Timestamps sometimes allow the recipient to know that a message from an honest party has been replayed. This is important in cryptographic protocols. These properties sometimes allow protocols using ...

2

I think that you're asking how to generate a timestamp response as defined in timestamp-protocol: RFC3161, with openssl to generate and sign the response using a PKCS#11 (HSM in your case) as a TSA signer. I think that there is no native way to use PKCS#11with openssl to do this. (maybe with some plugin like: opensc pkcs11 engine for openssl). If you take a ...

2

Your diagram is not very clear, but XOR is not a good combiner function to use for timestamping, as it may allow backdating in some circumstances. For instance, see the "time travel" attacks in Section 3.3 of the following paper (e.g., pp.179-180): Cryptanalytic Attacks on Pseudorandom Number Generators. Depending upon how many inputs you have to the XOR ...

2

This is exactly the scenario that the Timestamp Protocol has been created for. You need to provide your students with access to a trusted timestamping authority (TSA). This could be you yourself or someone else (like a CA offering that service). The TSA signes the hash of the document (the test with all answers) alongside the current date and if your ...

2

The way a stream cipher works, traditionally, is that $E_k$ produces a pseudorandom bitstream (the keystream) based solely on the key $k$. The message is then encrypted by XORing the message with the keystream. This has a number of consequences, notably that if you know both the plaintext and ciphertext, it's trivial to compute the keystream (if $C=M\oplus K$...

2

Firstly, if your plaintext is bigger than the block size of your symmetric cipher, then you can use a mode of operation which is compatible with your purpose. If you wish to simply have the timestamp and the plaintext at the end, you could use CBC for instance and encrypt a message which consists in the concatenation of your timestamps and of your plaintext,...

2

A timestamp in the message won't fix the problem with ECB mode. ECB mode uses the same key for each block, so you will leak the fact that blocks are the same within the same message, and if you use the same key static key for every update, between different messages as well. Consider a higher level library such as libsodium or spiped from tarsnap to avoid ...

2

I think this is a hard question to answer. However, I believe since you are utilizing a trusted third party, then one way to do this is to use trusted platform module (TPM) [read more about it on trusted computing] on the device that generated the photo. This TPM aims to prove for the utility provider that the image is taken on a specific time. The trusted ...

2

If being decentralized with no trusted timestamping authority that could backdate things is a must, then the solution is Bitcoin's blockchain (or a similar cryptocurrency's blockchain). OpenTimestamps is a project for efficiently using it to timestamp files. Most of the design for a possible basic decentralized cryptocurrency has been known since public key ...

2

Let me restate your game to be sure I understood you correctly: There's $n$ players Casino presents number $R$ Each player sends commitment to some number $0$ and $R$ After that casino sends "betting closed" signal to all players Each player sends his chosen number + proof for commitment Player with highest unique number wins Your problem is: how to proof ...

2

What he meant is quite unclear. It could be that he's referring to a Timestamping Authority (TA) (See related RFC like 3161). What they do is basically sign a document/hash with the current time and date and sequential transaction id (IIRC). Ideally, the TA is public and anonymous, allowing anyone to submit any hash and get a signed timestamp for it, the ...

2

AEAD constructions encrypt messages and append an authentication tag. That authentication tag is computed using the following data: The secret key The nonce The message, before or after encryption Optionally, some additional data During the decryption process, the authentication tag is computed using the same data, and compared with the one that was ...

2

Section 4 of the linked paper answers some of your questions: To implement a distributed timestamp server on a peer-to-peer basis, we will need to use a proof-of-work system similar to Adam Back's Hashcash, rather than newspaper or Usenet posts. The proof-of-work involves scanning for a value that when hashed, such as with SHA-256, the hash begins with a ...

1

Technically no. But practically, possibly, yes. Time is an absolute measurement using an agreed standard (UTC, hours, minutes, seconds, etc...). It's a human construct to log a progression of local (cosmically speaking) events against. By its definition, it requires a "witness" to validate, which is the same as saying "authority". Note: It's very important ...

1

Are there known any protocols or algorithms with precisely narrowed time estimate above? Of course not, because it would depend on the details of the system performing the brute forcing / dictionary attacks. Your comment: "Processor cycle count measurement by brute force breaking scheme" basically contains the answer. Is it possible to design such brute ...

Only top voted, non community-wiki answers of a minimum length are eligible