Questions tagged [timestamp]
For questions relating to physical or digital timestamps, usually as part of a cryptographic protocol, logging, or auditing requirement. Please use the tag [time] for questions relating to system clocks.
0
votes
2answers
60 views
TSA server with OpenSSL
From OpenSSL documentation of openssl-ts command:
HTTP server support is provided in the form of a separate apache module
Does anybody know which module is the one? I haven't found any module to ...
0
votes
0answers
31 views
Is a timestamp of hash(hash(document)) valid under eIDAS?
I have a document F that I don't have access to, but I have its hash H'(F) calculated with an algorithm H' that is not included in the list of recommended hash functions in EN 119 312 (referenced by ...
0
votes
0answers
57 views
Is it possible to build an ASiC container out of a file and its timestamp token? [duplicate]
If I have:
A file, X
The RFC3161 timestamp token of X
Are these sufficient to build a (single file) ASiC container with the file and the timestamp?
In other words, is the timestamp included in the ...
1
vote
0answers
253 views
Verify PKCS#7 (CMS) detached signature with timestamp with OpenSSL
I have a PKCS#7 (i.e., CMS) detached signature of a file that is signed by my signing certificate and then timestamp signed by a TSA that is all generated by an application we wrote. I would like to ...
1
vote
1answer
134 views
Is it possible to verify that a signature was made prior to the content of the document it is found on?
In What to do after I signed a blank sheet of paper given to me by my manager?, a distressed individual (B) has signed a blank piece of paper and given it to an adversary (A).
A has openly stated to ...
0
votes
1answer
147 views
Signing and timestamping implementation
I am writing a software that records and stores data files.
I want to digitally sign and time stamp these files so that I can assure that it's Contemporaneous and Attributable (to comply with 21 CFR ...
0
votes
1answer
37 views
How to have both TLS and Time Stamp Signing for data?
As you know, we use TLS for multiple purposes, including integrity, confidentiality and authentication and we use TSAs (Trusted Timestamp Authorities) to have signed timestamps for our data. (Read ...
1
vote
0answers
41 views
Is it possible that a usb drive manufactured 3 months ago can have data copied to it that shows the file last modified date before manufacturing date? [closed]
I have some data that needs to be handed to a friend. I don't want to give the original drive (drive-1), so I plan to purchase a drive (drive-copy) and copy data to it. The data copied will still show ...
0
votes
2answers
59 views
If a file on USB drive shows a certain “date modified” time in the windows explorer, can the correct added date/time be checked for the file?
If someone copied files from a drive-1 to usb-drive-2, then it seems the directories and files get the original modified time from drive-1 in some cases and in some cases not.
Can it be checked if ...
0
votes
1answer
54 views
How can one make sure that some specific directories are fully deleted (without any record of their deletion) from a USB/flash drive?
It seems data resides in USB somewhere until it's completely overwritten. But is there a way to delete big directories 10-100GB or so without zero-filling the remaining space and only eradicating ...
0
votes
2answers
87 views
Is it possible to verifiably timestamp a video?
I am wondering if there is a way to timestamp a video. (e.g. Security camera footage)
I know that there is a way to timestamp a document with a trusted time authority, and it will certainly be ...
1
vote
2answers
74 views
How to capture not only the mtime but also the ctime when making forensic copies of files?
Context
I'm investigating a compromised Linux box where I found files with malicious code. The file system is too big to just make a copy of the whole block device and so far I'm only interested in ...
1
vote
0answers
89 views
Error while Verifying OpenSSL Timestamp Response
Good morning. I'm having a weird issue while verifying a response from a TSA (TimeStamping Authority). I'm using the TimeStamping Service from the ERMIS Gateway (Hellenic Public Administration). I use ...
3
votes
1answer
228 views
When would a Authenticode signature expire?
I'm curious about how Windows check the Authenticode signature.
For example, I would sign test.exe
I know that if test.exe doesn't have a TS (timestamp) signature from a TSA (Timestamp Authority)...
1
vote
1answer
144 views
Do any third party time stamping signature services exist?
I'm wondering if there exists any trusted third-party service that I can submit a file, or just a signature of a file, and get back a signature of that file signed with the timestamp of when it was ...
1
vote
0answers
38 views
Use of ESSCertIDv2 in a RFC 3161 Timestamp
A qualified trust service provider under eIDAS uses ESSCertIDv2 for their time stamp tokens, but ESSCertIDv2 was not present in the RFC 3161 specification, it was added later in RFC 5816.
RFC 3161 in ...
8
votes
1answer
3k views
What is the purpose of JSON Web Token (JWS)'s issued at “iat” field?
RFC 7519 specifies an optional "iat" field, indicating when a token was issued. The RFC provides a terse commentary:
This claim can be used to determine the age of the JWT.
What is the purpose ...
2
votes
2answers
393 views
Does x509 have an “issued at” timestamp? Can you tell when an x509 certificate was issued?
The JWT Spec (RFC 7519) has an issued at field ("iat"). Does x509 have any analogous value? I see a Validity field, but nothing else time related.
1
vote
2answers
617 views
How to timestamp a document without electronic signature under eIDAS
I need to timestamp a file to prove data integrity, not authorship. I will use a RFC3161 qualified timestamping service.
From the EU Regulation Section 6, Article 41, I understand that I can use a ...
0
votes
1answer
631 views
How to extract TSA certificate from tst file?
I have several timestamp token files that I think should have TSA certificates embedded within them because the "Request TSA certificate" option was selected when I requested them with TimeStampClient....
1
vote
1answer
261 views
Adding custom embedded Precertificate SCTs into the certificate?
It it possible to insert a list of ct certificate timestamps in the my own certificate created in by internal CA using openssl configuration file. I didnt find any information about ASN.1 sequence ...
0
votes
1answer
126 views
Dual Code Signing: Should SHA-1 signature have a SHA-1 or SHA-2 timestamp?
I am signing executables for our software both with a SHA-1 and a SHA-256 signature. In addition I timestamp both of these signatures.
Here I am wondering: I can timestamp the SHA-1 signature with a ...
5
votes
1answer
242 views
Any Known countermeasures against clock skew fingerprinting?
I know lots of websites that do clock skew fingerprinting using tcp timestamps. I know how to disable timestamps but i want to know techniques that can be used to counter clock skew fingerprinting. I ...
4
votes
1answer
486 views
Issuing TSA (Time Stamping Authority) certificates
What is a practice for issuing TSA (Time Stamping Authority) certificates?
I read that TSA certificates should be issued directly from Root CA, but basically TSA certificate is end entity certificate ...
6
votes
1answer
799 views
Mitigate Time Spoofing Attack
Say Alice receives synchronized time from Tina the timekeeper. Say Ted spoofs a GPS signal, fooling Tina about the current time. Tina sends this fake time to Alice.
What can Alice do to avoid being ...
3
votes
2answers
123 views
Can a time stamp protect a signature with the obsolete SHA1?
I am trying to figure out the scope of SHA1 deprecation for existent signatures. Reading this.An attacker (after 110 years) could present a fake document for a valid signature
I believe this only ...
1
vote
1answer
211 views
Why AdES -A signatures require TWO timestamps?
Latest ETSI standard CAdES, XAdES and PAdES require for baseline profile LTA to fulfill previous LT, T and B levels. Summarizing,the conformance requirements are:
B : Base signature with content-...
37
votes
9answers
13k views
How to prove a picture was taken before a certain date? [duplicate]
I need to prove that all my pictures were taken before a certain date. Is uploading them to Picassa, Flickr or a similar service a good way to achieve such timestamping?
38
votes
2answers
3k views
How to prove that a file was not created in advance
Sometimes we need to prove that a file was not created in advance - a good example is warrant canaries. The person releasing them may have been forced to sign the file with a future timestamp. For ...
2
votes
0answers
105 views
How to put the “trust” into trusted-timestamping
As a part of my thesis, I am about to evaluate different approaches to establish the trust in trusted-timestamping performed by a TSA (see RFC3161 - Trusted Timestamp Protocol).
A trustworthy ...
3
votes
1answer
202 views
Is RFC 3161 necessary?
As I've been implementing RFC 3161 software components, I got to thinking about running my own TSA and how one really proves the integrity of a time stamp (preferably without violating patents). I ...
1
vote
1answer
677 views
How to prove that something happened before some time in a distributed way? [closed]
To prove that something happened after some time in a distributed way, just refer to something publicly know just before. Is that right? (Though I wonder how to make the time granularity smaller.)
...
3
votes
1answer
4k views
SHA-256 Timestamp not recognized in windows 7 when dual signed
I wanted to dual sign my exe so that the XP and Vista users can use the software. But when i dual sign the exe with SHA1 and SHA256 timestamps, In windows7 only 1 timestamp is shown.
To dual sign I ...
1
vote
1answer
203 views
Why timestamping chain is better than “code signature” chain?
Timestamping is recommended as the way to prolong signature validity after its certificate expiration date. One just need to add new timestamp signature before previous timestamp is expired.
But what'...
1
vote
1answer
1k views
Timestamp vs Replay attack
1) A → B : username, timestamp, h(password)
2) A → B : username, h(password), h(timestamp)
Can above two formula prevent from suffering replay attack?
I think 1 is immune from replay attack but i ...
3
votes
0answers
94 views
Is there a cryptographically secure way to verify the date of a process? [duplicate]
I have a few git repositories of content that will be updated constantly over the next decade. At some point down the road I anticipate being asked to prove that the content was actually in the state ...
3
votes
2answers
365 views
Could I use a TimeStamp also as IV?
For an academic application, I use AES-GCM to encrypt my frames between 2 parties.
To enhance security, and reduce the possibility of replay, I'd like to use a TimeStamp in my frame exchanges. But, ...
1
vote
1answer
1k views
Can setting the date on your iPhone to the epoch really brick it? [closed]
So, I've started seeing warnings that there is a troll/hoax saying that people should set the date on their phone to 1st January 1970 to get a retro logo to display.
The warnings say that this will ...
1
vote
1answer
248 views
Generation of a shared nonce that cannot be pre computed [closed]
Is there any system out there currently, which can generate a nonce, which all nodes on a distributed network can agree and calculate the same nonce at the same time, but one an attacker cannot pre ...
0
votes
1answer
294 views
Different Microsoft-signed excecutables have apparently the same signature!
On Windows 10 systems, I found two versions of bootsect.exe (a Microsoft-supplied utility that writes disk boot sector) with different hashes (SHA-1 9b7463c79460a55a36b53bee0889f894b2379ec3 for one ...
10
votes
1answer
15k views
Pros and cons of disabling TCP timestamps
So, lynis informs me that I should unset net.ipv4.tcp_timestamps.
I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
5
votes
1answer
629 views
Verification of a timestamped PDF
I'm kinda new to the process of timestamping files to provide digital integrity.
For testing purposes, i use tsa.safecreative.org for PDF files.
Now i've signed a couple PDF files and if i open up ...
0
votes
5answers
198 views
How to make sure nobody has read this!
Is there any computer/server which would allow me to get "guaranteed read access history" for files?
For example, suppose I made a file with my plaintext passwords and simply wanted to make sure that
...
1
vote
1answer
338 views
How can I put in relation http timestamp with country time zone of the IP?
I have a series of packets within a PCAP files,
among them I'm getting packet with HTTP protocol.
starting from IP address I get the timestamp in GMT format and the time zone, for example:
Source IP:...
2
votes
5answers
268 views
Proving an action was done at an exact time - a posteriori
I was thinking about the way git allows to edit the timestamp on commits, and how you can rewrite (public) history that way.
I then drifted from that to "can we prove someone did an action at time X ...
2
votes
1answer
570 views
Reliability of scanning tools on icmp timestamp responses
A security auditor has done a vulnerability scan of our network and found that one of our server has returned an TCP timestamp response such that the scanner (Nmap) is able to guess the uptime of the ...
2
votes
1answer
347 views
Is a Fernet token's timestamp a security risk?
A Fernet token has the following format:
Version ‖ Timestamp ‖ IV ‖ Ciphertext ‖ HMAC
As the above shows, the timestamp is not part of the ciphertext, so anyone can read the time the token was made. ...
-1
votes
1answer
128 views
Are there security implications to not installing the Leap Second patch on Red Hat systems? [closed]
What are Leap Seconds?
A leap second is a second which is added to Coordinated Universal Time (UTC) in order to synchronize atomic clocks with astronomical time.
The reason we have to add a second ...
5
votes
1answer
194 views
Random padding in hash functions
In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
1
vote
3answers
89 views
Is it safe to include timestamps in error codes that are shown to the users?
If an error occurs, our web shop generates an error-code that is shown to the user. At the moment, it does not contain a time stamp but only the day of the month. That is non-intuitive but I assume ...
