I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a challenge/hash that I provide. I do not care if an active adversary feeds my trusted device an old (even very old) date/time ; I’m only concerned with attempts to feed it a date in the future. My trusted device could be a Smart Card that I can program, connected to an untrusted PC.
I would like something with no fee or need to authenticate in order to obtain a new certificate. I'm OK for a yearly fee to the authority providing me that service. I anticipate a mere ten thousands requests over a year. I could live with service interruptions or date/time lag not exceeding an hour.
I’m thinking of purchasing a regular SSL (or similar) certificate from a commercial CA, and using the revocation services they provide for that certificate, which I’m told respond to queries « is this certificate still valid? » with a signed message « by (explicit current time) this certificate is valid », that I’m then able to check using the long-term CA public key.
Does that seem sound? Which suitable protocol is widely supported by commercial CAs? Is my usage allowed by normal commercial CA practices/term of uses?
I'd very much prefer something such that the trusted device can verify a moderate amount of data (e.g. signed message, certificate), statically submitted to it by the untrusted PC host.
The job of the trusted device should be simple (due both to limited resources, and the need to ascertain that the implementation is secure).
I would prefer that the cryptographically signed date/time could be obtained in a single TCP/IP session, and I'm not ready to setup an email address per point where I need this service.
My requirement for free requests is not so much about the fee, but about the practical need to authenticate in order to request anything obtained for a fee. A password is out of question. Even a weak authentication by IP does not fit (switch to a backup internet access in an emergency and poof goes the availability).
I have nothing against a free service, but I'm willing to pay to lower the odds that the service is terminated, and make someone embarrassed if the clock jumps in the future.