Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to create a timestamp that is so hard to fake, that it could be used as proof or simply strong evidence in a court of law, that something was not created after a certain point in time?

The file could be anything; a word document, an image, an audio file, a software specific file, ie. PSD.

Some ways I think might work are by uploading it to a reputable cloud or social networking site but what if by some twist of fate the large company goes bust and I can no longer prove it?

What is the most secure, hardest-to-fake, longest lasting (not likely to become invalid anytime soon) way to prove that a digital file was not created after a certain point in time?

It could still be possible to fake, but preferably by some highly advanced means that makes it unlikely.


The use case I'm essentially envisioning is:

A simple 'your word against theirs' situation.

Against all sane advice, I create a file on a pay-if-you-like-it basis, with no written contract. They like it and use it, but don't pay.

I want to sue them with very strong evidence that I created the file before them (if they're trying to argue that they made it themselves - like a simple branded word template).

I'm not looking for advice from a legal standpoint, but expertise about timestamps, and how to create one with strong authenticity (I think).

share|improve this question
    
I think this is a legal question rather than an information security question. Am I correct? –  Hugh May 2 at 0:38
    
Just a thought. Sign the timestamp and store it somewhere. –  Rell3oT May 2 at 0:41
    
Uploading it somewhere would only serve as proof that it existed since before the upload time, and I read your question as ways to prove it was created during some short-ish time period. So you're missing the indisputable proof that it couldn't have been created too far back in time since the upload time. There's a lot of frequently updated, well archived and utterly random data that you could use for that, say stock market quotes, sports results,... for some day. Then all you'd need is authenticity verification (i.e. checksum) that the document wasn't changed since the date of publishing. –  TildalWave May 2 at 0:51
    
@TildalWave If you uploaded it moments after you created it, it would achieve the desired effect to a small degree. I'm actually not bothered about proving that it wasn't created before that specific time, but that it wasn't created after. I should clarify in the Q. –  Mr E. Upvoter May 2 at 0:57
    
I think it would help if you said why you want to create this sort of thing? What scenario would this be useful in? –  BubbleMonster May 2 at 17:05

5 Answers 5

Just last week I heard of this Proof of Existence service that makes a secure digest of your file and gets it added to the public Bitcoin blockchain.

So henceforth and forevermore (or until Bitcoin is cracked or abandoned), you'll have publicly-certified, publicly-verifiable proof that THAT particular instance of your file existed at that time. Even if the Proof of Existence web service goes away, you could conceivably use a blockchain explorer tool to show the earliest date that your secure digest showed up in the blockchain.

share|improve this answer
1  
This is a cool use of the blockchain since its a public record; I am not sure if there could be issues with the time being trusted throughout the blockchain. I found another similar effort: btproof.com –  Eric G May 2 at 1:52

Much like with public key crytography, where you are relying upon some trusted authority for identity, there are timestamp authorities. An organization can setup one internally or could rely on a trusted third party (or multiple trusted third parties) to sign a document.

If the timestamp authority is trusted, then you can provide reasonable assurance of the time it was stamped (not necessarily created or modified). A timestmap generally relies upon crytographically signing a hash and crytographically signing of token for the timestamp. In this way you have some trusted authority validating the time and the document.Acrobat and other PDF programs allow you to point to a timestamp server which you can then use when signing files (or just timestamp them). There are also ways of doing this manually against a file.

A good place to start is with RFC 3161 + RFC 3628 and this article on "trusted timestamps". Check out a related question on Stack Overflow, and this one on Crypto.


For any specifics on legality and court admissibility, please reach out to specific legal counsel familiar with that particular court's requirements.

Some laws and directives for various regions:


There are also a lot of SaaS solutions where you can click to sign, but you rely upon the mechanisms of the service, which may not tie to any standard. I have been asked to sign documents using the DotLoop service, but have not evaluated their tech specs.

share|improve this answer

One possible solution is to make a cryptographic hash, e.g. SHA256, of whatever data you want to use the timestamp with and then publish that hash; maybe on the internet which includes saving by the wayback machine or google cache, etc., or have it signed by a trusted party.

In many cases, the person whose potential later lawsuit you want to defend against has some relationship with you that may give him an incentive to sign it himself. In many cases, it may even be possible to put the burden entirely on that person simply by keeping a public log (website?) of such published hashes.

Whilst I am no lawyer, I believe even just continuing to consistently carry out such logging will help your case at least somewhat. That is the solution you asked for, providing some proof that you did not backdate the timestamp into the past because you could not know the hash (a one-way function) without having the data you wanted timestamped.

share|improve this answer

If it doesn't rely on a reputable external sources for validation, I do not think it's possible. As long as the data (timestamp) is stored in local, the data will be stored in some part of the hard disk. And any part of the hard disk data can be easily overwritten with special tools like hex editor as long as you have physical access to the hard disk. And in this case I believe the lawyer or professional expertise will question the integrity of the data (reputation and possibly of tampering and etc).

Unless it's a Read only drive, if not there's no way to prevent the data to be "fake" or overwritten in this case. However a read only memory here is impossible as you need to write the timestamp into the data.

Or unless there's some new special memory technology that would allow permanently writing data only once and can't be altered after writing once, if not there is no way you can do it.

share|improve this answer
    
Hi Sky, thanks for answering, I just clarified the question as you were writing this. I'm also looking for the most bona fide method for creating an almost indisputable timestamp. –  Mr E. Upvoter May 2 at 0:53
    
Dominic, what are you trying to achieve at a higher level? Besides "indisputable time stamps"? The problem is you will never overcome a trust model with a system you own and have absolute control over, without external sources and controls (which you have no permissions to) over it. –  0xSheepdog May 2 at 0:58
    
Ahh, the keyword I should've highlighted was almost. If not entirely indisputable, what's the strongest credibility timestamp I could create, that can also rely on external sources if necessary? –  Mr E. Upvoter May 2 at 1:02
    
@Dominic there's no 'indisputable timestamp' for the current technology we have now. In court you will be questioned on how the data is 'real' through implementation of data integrity. If I'm one of the expertise that is called on the court and knowing that your timestamp is stored in local, I would question you "how can I trust you?". You have full control over your data and you're not someone who is reputable, how can I be so sure that you did not alter the edit. –  Sky May 2 at 1:04
    
@Domnic The reason to store externally is having someone else be the "witness" party. Someone who is reputable to vouch for you and not related to you. Something which you don't have permission or you can control / manipulate with. This will make other trusts the integrity of the data. However everything is still arguable in the eyes of court, so it's eventually how well you implement your system logics. –  Sky May 2 at 1:06

Essentially, no.

Caveat H@x0r: I.A.N.A.L. *

Timestamps are essentially numbers. A number that represents how many seconds after an arbitrary time&date the event (which the time stamp refers to) occurred. This "arbitrary" time is known as an epoch: https://en.wikipedia.org/wiki/Epoch_(reference_date)

A timestamp is simply a number. Data. A value. And values can change, or be changed. So no, creating a "time stamp" itself that is indisputable in a court of law is not really possible.

A court of law (civil or criminal) is not really about the absolute truth, but what the rules, the system, the precedents, and the lawyers arguments and positions can achieve.

As for a timestamp that does not require external validation or sources but is trusted by everyone? Not humanly possible. You would have to get all external parties (i.e. EVERYONE and EVERYTHING else) to agree on your system and methodology. Sorry. You are asking borderline philosophical questions in the Legal and Security realms here; there are no easy answers.

* I Am Not A Lawyer

* EDITs to my answer after edits to the question *

The best you are probably going to be able to do is going to require external sources. You will want to do some hashing, of the file and attributes as well as a message from an external source. That external message will be the "key" that you have no control over, and use to validate the integrity of your file and timestamp attribute.

The key/external message needs to come from a source that you have no influence over, and can rely on to provide that key again, including its origin metadata (when it was used, etc.) in the future if subpoenaed.

I'm thinking something like the secure NTP time sync from an official (i.e. government) source. I don't know enough about NTP or the heirarchy, but believe you can get digitally signed/secured updates from some sources; if so, that is probably the path you need to explore.

The next problem is putting that hash somewhere that can be validated and viewed by others, so you cant change things over time without being noticed. You are basically painting yourself into a corner...

Note: THIS IS NOT A COMPLETE ANSWER. I have a good grounding in crypto concepts, but I'm not a math guy nor a crypto-geek. These are basic, journeyman concepts. You have a lot of research to do.

share|improve this answer
1  
Sorry, I've altered it quite a bit, which might make your answer seem odd. This is now the question I'm essentially trying to ask. –  Mr E. Upvoter May 2 at 1:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.