Tag Info

Hot answers tagged

6

I think you could use any web site operated by a reputable company that supports access over SSL. The one quirk is that the list of certificate authorities that might sign their certificate could change. For example if you retrieve https://www.google.com/ you'll get something like: HTTP/1.0 200 OK Date: Tue, 06 Dec 2011 17:02:40 GMT Expires: -1 ...


6

First things first. What's the problem you are trying to solve ? What is the attack model ? We cannot tell whether a protocol achieves a given goal if the said goal has not been given. Apparently, you are dissatisfied with Time Stamp Authorities as they are commonly used. Let's see what TSA do and on what security property they rely. A TSA emits time ...


4

A CRL is a signed object, just like a certificate. This is why they need not be covered by the actual document signature. However, for long-term archival, they need to be timestamped. The theoretical background is the following: At a given time T, you may validate certificates and verify signatures by using just-downloaded CRL, which give guarantee about ...


4

Digital signatures "expire" because a signature is performed with a private key and verified against the corresponding public key. The public key is linked to an identity (e.g. a legally defined individual) through certificates. The usual standard for certificates (X.509) specifies that certificates expire. Beyond the expiration date, the certificate shall ...


3

Time stamping is meant to provide a verifiable proof that a given piece of data "existed" at some past date. One widespread time stamping protocol is described in RFC 3161: technically, the TSA (Time Stamping Authority) computes a digital signature on a structure which includes the current date (at the time of signature, as known by the TSA) and a hash value ...


3

Your best approach would be to secure multiple signatures from different trusted authorities. In case one of the private keys is compromised, the file could still be validated. This will incur additional costs, but increase resilience to certificate revocation. Or you could also establish a (more costly yet) procedure of periodic certificate revalidation ...


3

A certificate for a Time Stamp Authority is accepted as such only if it contains an Extended Key Usage extension which itself advertises the specific id-kp-timeStamping object identifier (aka 1.3.6.1.5.5.7.3.8). Though Authenticode time stamps do not follow the RFC 3161 format, the rules on the TSA certificate are still the same (see section 2.3). There is ...


2

When a certificate is revoked, the CRL contains the revocation date which tells at which date the certificate became "invalid". Indirectly, it specifies that the certificate was fine up to that date. For instance, if a private key is compromised after a burglary, the security camera recordings will be used to determine at which hour the key was stolen, and ...


2

If I understand what you are asking, it seems to me you are looking for a File Integrity Monitoring solution. Are you familiar with FIMs, or have you researched them? Do you think that fits what you are looking for? Not sure what budget you are working with, but Tripwire is popular FIM vendor.


2

If you are ready to make an explicit request every time you want a signed time token, then you may as well request a regular time stamp. There are a number of free time stamping services around here, operated by CA for use with Authenticode. For instance, at that URL: http://timestamp.globalsign.com/scripts/timstamp.dll there appears to be a TSA which ...


1

A easy to use, intuitive, and corporate and court friendly implementation of digital certificates and digital signed timestamps in in Adobe's acrobat. You can use any digital certificate and you can easily configure it to use an RFC 3161 timestamp authority. The digital signature and timestamp is stored in a metadata and there is built in functionality for ...


1

Please see other answers on this site that provide resources on secure timestamping: On-line cryptographically signed date/time? Signature and Timestamp for Long Term Document Archival Question Whic one is a good service of timestamp? [closed] Geographic equivilent of RFC 3161 (X.509 PKI Time-stamp Protocol) and on Crypto.SE: How are timestamps ...


1

Google Search Free one that has been around forever: http://www.itconsult.co.uk/stamper.htm Aside from that, your first paragraph is hard for me to understand. Your 3rd paragraph seems brilliant for preventing future-time signature. A hash of your data + a timestamped and signed revocation response from a CA does provide great confidence that the message ...



Only top voted, non community-wiki answers of a minimum length are eligible