Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service to achieve this, as requested in this great question, but rather a method for the achievement of such a service.

For the legal (in most any law system) authentication of text content and its submission time, the owner of the content would need to prove:

  • that the timestamp itself has not been altered and was accurate to begin with

  • that the text content linked to the timestamp had not been altered

I'd like to know how to achieve this via programming (not a language-specific solution, but rather the methodology behind the solution).


  1. Can a timestamp be validated to being accurate to the time that the content was really submitted?

  2. Can data be stored in a form that it can be read, but not written to, in a proven way?

  3. Is there another method of achieving this that I haven't specified?

In other words, can I save & store a user's submission in a way that proves that the data has not been altered, and that the timestamp is accurate?

I can't think of any programming method that would make this possible, but I am not the most experienced programmer out there. Based on MidnightLightning's answer to the question I cited, this sort of thing is being done.


Clarification: I'm looking for a method (hashing, encryption, etc) that would allow an average guy like me to achieve the desired effect through programming.

I'm interested in this subject for the purpose of Defensive Publication.

share|improve this question
    
I've cross posted this question on Programmers SE and this site, with the intention of getting different types of expertise from the two communities. Review this Meta SE Question which describes a cross post that is on topic for both sites. –  user47733 Jun 11 at 23:20
    
Also, I hope that this is in fact on topic here, and I'll be glad to make any necessary changes (possibly remove the focus on programming?) to make this a better fit here. –  user47733 Jun 11 at 23:21
    
What about regularly sending the completed data with timestamp to a 3rd party (backup storage)? The timestamp of the 3rd party could be considered sufficient validation of the time. –  schroeder Jun 12 at 0:13

2 Answers 2

I can set the clock on my computer (server) to any time, and there's no way for software running on it to know that this is the wrong time, so proving a timestamp is difficult. One approach is that you could produce a hash chain, but this only means that you've hashed things in a certain order, you're still not able to prove at exactly what point you've hashed it.

One approach is to involve a trusted third party -- someone who can sign requests with a timestamp that they certify, and who is not a party to any disputes, and thus should be impartial and not forging timestamps. This is known as trusted timestamping and even has an RFC.

So the answer is yes, you can do this, but only by involving a 3rd party.

share|improve this answer
    
Thanks, I altered my question to include answers like this, specifying options outside of programming, which is a necessary edit to reform this question for this site. –  user47733 Jun 11 at 23:40

You could publish the hash of a post in a public "forum", for example the "Bitcoin ledger":

How does Bitcoin work?

The block chain is a shared public ledger on which the entire Bitcoin network relies. All confirmed transactions are included in the block chain. This way, Bitcoin wallets can calculate their spendable balance and new transactions can be verified to be spending bitcoins that are actually owned by the spender. The integrity and the chronological order of the block chain are enforced with cryptography.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.