The date of a file on your computer proves nothing: it can be changed in a few clicks, and it changes on its own when the file is copied. Yet you often need to show that a document existed in a certain form on a certain date: a project before a presentation, a contract before a certificate expired, digital evidence collected before it was taken down. A cryptographic timestamp exists precisely for this.
The idea: a trusted third party signs a fingerprint and a time
A timestamp is a statement signed by a third party, called a Time Stamping Authority (TSA), declaring: "this data fingerprint existed at this moment".
The procedure is standardised, notably by the RFC 3161 specification, and works like this:
- you compute the hash of the document, for example with SHA-256, on your own computer;
- you send the authority only the hash, not the document;
- the authority combines the hash with the date and time taken from a reliable source and signs it all with its private key;
- you receive a timestamp token, which you keep together with the document.
To verify the timestamp in the future, you simply recompute the document's hash, compare it with the one in the token and check the authority's signature against its certificate.
Confidentiality guaranteed
Because the authority receives only the fingerprint, the content of the document remains private. The document cannot be reconstructed from the hash, and the authority does not even know what kind of file it is. You can therefore timestamp confidential documents without revealing anything about them.
What it proves and what it does not
A timestamp shows that that exact content existed no later than the date indicated. If the document is changed even slightly, the hash changes and the timestamp no longer matches.
It does not prove:
- who the author of the document is: that requires a signature;
- that the content is true: the timestamp attests existence, not truthfulness;
- that the document did not exist earlier: it sets an upper limit, not the date of creation.
That is why timestamps and digital signatures are often used together: the signature says who, the timestamp says when.
Qualified timestamps
Within the framework of the European eIDAS regulation there is the qualified electronic time stamp, issued by a qualified trust service provider. The regulation grants it a presumption of the accuracy of the date and time it indicates and of the integrity of the data to which it refers, and recognises it in all member states. Non-qualified timestamps are not worthless, but their reliability may have to be demonstrated.
In Italian practice, timestamps are usually bought in bundles from qualified providers and applied with signing software. Timestamped files may appear with extensions such as .tsd or .m7m, which contain document and timestamp together, or with a separate timestamp file.
The most common uses
Extending the validity of signatures
A signing certificate has an expiry date and can be revoked. A timestamp applied to the signed document proves that the signature was made while the certificate was still valid, and allows it to be verified even years later.
Proving prior existence of a work or idea
People who develop software, write texts, create graphic designs or document an invention can timestamp versions of their work. In the event of a dispute, they can show that they possessed that content on a certain date.
Fixing digital evidence
In digital forensics work, timestamps are used to fix the hash of an acquisition in time: they show that the set of collected files has not been altered after a certain date.
Electronic logs and records
Access logs, minutes and administrative documents can be timestamped periodically so that any later alteration becomes evident.
Limits over time
Timestamps age too. The authority's certificate has an expiry date, and hash and signature algorithms can weaken over the years. For documents to be kept for a very long time, re-timestamping is used: before the timestamp becomes weak, a new one is applied with updated algorithms, covering the document and the previous timestamp. This creates a chain of evidence that extends over time.
What about blockchains?
Some services record a document's hash in a public blockchain, obtaining a proof of existence that is hard to alter. It is an interesting technique that anyone can verify, but it is not a qualified electronic time stamp under eIDAS and the time precision is lower. For formal needs, the qualified timestamp remains the most solid tool.
In short
- A timestamp is a token signed by an authority that binds a document's hash to a date and time.
- Only the hash is sent to the authority, so the content stays confidential.
- It proves the content existed by a certain date, not who wrote it or whether it is true.
- A qualified eIDAS timestamp enjoys a presumption of accuracy recognised across the Union.
- For long-term preservation, periodic re-timestamping is used.
