Questions tagged [timestamp]
For questions relating to physical or digital timestamps, usually as part of a cryptographic protocol, logging, or auditing requirement. Please use the tag [time] for questions relating to system clocks.
102 questions
6
votes
1
answer
2k
views
Mitigate Time Spoofing Attack
Say Alice receives synchronized time from Tina the timekeeper. Say Ted spoofs a GPS signal, fooling Tina about the current time. Tina sends this fake time to Alice.
What can Alice do to avoid being ...
- 1,630
3
votes
2
answers
344
views
Can a time stamp protect a signature with the obsolete SHA1?
I am trying to figure out the scope of SHA1 deprecation for existent signatures. Reading this.An attacker (after 110 years) could present a fake document for a valid signature
I believe this only ...
- 270
0
votes
1
answer
679
views
Why AdES -A signatures require TWO timestamps?
Latest ETSI standard CAdES, XAdES and PAdES require for baseline profile LTA to fulfill previous LT, T and B levels. Summarizing,the conformance requirements are:
B : Base signature with content-...
- 270
38
votes
9
answers
27k
views
How to prove a picture was taken before a certain date? [duplicate]
I need to prove that all my pictures were taken before a certain date. Is uploading them to Picassa, Flickr or a similar service a good way to achieve such timestamping?
- 413
39
votes
2
answers
3k
views
How to prove that a file was not created in advance
Sometimes we need to prove that a file was not created in advance - a good example is warrant canaries. The person releasing them may have been forced to sign the file with a future timestamp. For ...
5
votes
1
answer
464
views
How to put the "trust" into trusted-timestamping
As a part of my thesis, I am about to evaluate different approaches to establish the trust in trusted-timestamping performed by a TSA (see RFC3161 - Trusted Timestamp Protocol).
A trustworthy ...
3
votes
1
answer
385
views
Is RFC 3161 necessary?
As I've been implementing RFC 3161 software components, I got to thinking about running my own TSA and how one really proves the integrity of a time stamp (preferably without violating patents). I ...
- 31
1
vote
1
answer
2k
views
How to prove that something happened before some time in a distributed way? [closed]
To prove that something happened after some time in a distributed way, just refer to something publicly know just before. Is that right? (Though I wonder how to make the time granularity smaller.)
...
- 131
3
votes
1
answer
6k
views
SHA-256 Timestamp not recognized in windows 7 when dual signed
I wanted to dual sign my exe so that the XP and Vista users can use the software. But when i dual sign the exe with SHA1 and SHA256 timestamps, In windows7 only 1 timestamp is shown.
To dual sign I ...
- 143
1
vote
1
answer
295
views
Why timestamping chain is better than "code signature" chain?
Timestamping is recommended as the way to prolong signature validity after its certificate expiration date. One just need to add new timestamp signature before previous timestamp is expired.
But what'...
- 115
1
vote
1
answer
3k
views
Timestamp vs Replay attack
1) A → B : username, timestamp, h(password)
2) A → B : username, h(password), h(timestamp)
Can above two formula prevent from suffering replay attack?
I think 1 is immune from replay attack but i ...
- 145
3
votes
0
answers
182
views
Is there a cryptographically secure way to verify the date of a process? [duplicate]
I have a few git repositories of content that will be updated constantly over the next decade. At some point down the road I anticipate being asked to prove that the content was actually in the state ...
- 1,324
3
votes
2
answers
955
views
Could I use a TimeStamp also as IV?
For an academic application, I use AES-GCM to encrypt my frames between 2 parties.
To enhance security, and reduce the possibility of replay, I'd like to use a TimeStamp in my frame exchanges. But, ...
- 313
1
vote
1
answer
1k
views
Can setting the date on your iPhone to the epoch really brick it? [closed]
So, I've started seeing warnings that there is a troll/hoax saying that people should set the date on their phone to 1st January 1970 to get a retro logo to display.
The warnings say that this will ...
- 139
1
vote
1
answer
477
views
Generation of a shared nonce that cannot be pre computed [closed]
Is there any system out there currently, which can generate a nonce, which all nodes on a distributed network can agree and calculate the same nonce at the same time, but one an attacker cannot pre ...
- 11
0
votes
1
answer
570
views
Different Microsoft-signed excecutables have apparently the same signature!
On Windows 10 systems, I found two versions of bootsect.exe (a Microsoft-supplied utility that writes disk boot sector) with different hashes (SHA-1 9b7463c79460a55a36b53bee0889f894b2379ec3 for one ...
- 1,275
19
votes
3
answers
41k
views
Pros and cons of disabling TCP timestamps
So, lynis informs me that I should unset net.ipv4.tcp_timestamps.
I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
- 931
6
votes
1
answer
1k
views
Verification of a timestamped PDF
I'm kinda new to the process of timestamping files to provide digital integrity.
For testing purposes, i use tsa.safecreative.org for PDF files.
Now i've signed a couple PDF files and if i open up ...
- 608
0
votes
5
answers
298
views
How to make sure nobody has read this!
Is there any computer/server which would allow me to get "guaranteed read access history" for files?
For example, suppose I made a file with my plaintext passwords and simply wanted to make sure that
...
- 240
1
vote
1
answer
518
views
How can I put in relation http timestamp with country time zone of the IP?
I have a series of packets within a PCAP files,
among them I'm getting packet with HTTP protocol.
starting from IP address I get the timestamp in GMT format and the time zone, for example:
Source IP:...
- 167
3
votes
5
answers
735
views
Proving an action was done at an exact time - a posteriori
I was thinking about the way git allows to edit the timestamp on commits, and how you can rewrite (public) history that way.
I then drifted from that to "can we prove someone did an action at time X ...
- 143
2
votes
1
answer
944
views
Reliability of scanning tools on icmp timestamp responses
A security auditor has done a vulnerability scan of our network and found that one of our server has returned an TCP timestamp response such that the scanner (Nmap) is able to guess the uptime of the ...
- 1,971
2
votes
1
answer
600
views
Is a Fernet token's timestamp a security risk?
A Fernet token has the following format:
Version ‖ Timestamp ‖ IV ‖ Ciphertext ‖ HMAC
As the above shows, the timestamp is not part of the ciphertext, so anyone can read the time the token was made. ...
- 125
-1
votes
1
answer
186
views
Are there security implications to not installing the Leap Second patch on Red Hat systems? [closed]
What are Leap Seconds?
A leap second is a second which is added to Coordinated Universal Time (UTC) in order to synchronize atomic clocks with astronomical time.
The reason we have to add a second ...
- 1,479
5
votes
1
answer
327
views
Random padding in hash functions
In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
- 153
1
vote
3
answers
475
views
Is it safe to include timestamps in error codes that are shown to the users?
If an error occurs, our web shop generates an error-code that is shown to the user. At the moment, it does not contain a time stamp but only the day of the month. That is non-intuitive but I assume ...
- 1,104
1
vote
1
answer
302
views
Keeping signatures valid even after the private key has been compromised
If I understand the topic of digital signatures correctly, you sign a message via hashing+encrypting it using your private key.
Then, if a private key is compromised by an attacker, she could sign ...
- 113
-3
votes
1
answer
762
views
Authentication protocol based on hash function [closed]
Is it possible that Alice can authenticate Bob without using any secret information except her password, i.e they don't share any thing else. If so, how can I authenticate Alice and ensure the ...
- 1
13
votes
2
answers
17k
views
TLS reliance on System Time
I'm interested to know if there is any reliance on system time (as defined by Linux or windows) when initiating a secure handshake. I'm aware that TCP typically uses a random number (RFC 1323) to ...
- 549
11
votes
2
answers
4k
views
How do systems protect against a stolen code-signing certificate after the certificate expires?
Imagine this scenario:
1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp.
15th December 2014 - the certificate is revoked. Malware will be prevented from ...
- 113
0
votes
1
answer
2k
views
Verification code generation and expiration
I am trying to implement an application that includes registration,
In order to register to the system the user shall enter his organization ID number let's say. To verify the user identity, a ...
- 103
3
votes
2
answers
896
views
Does NTP leak local system time?
As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
- 784
3
votes
1
answer
431
views
Is code-signing with a non-ssl timestamp unsafe?
Assuming your code-signing tool is secure (e.g., does not suffer from buffer overflow exploits and the like), is there any reason to be concerned if a time-stamping service is not running over SSL? ...
- 1,015
3
votes
5
answers
8k
views
Password protect an excel file for a period of time? [closed]
I'm trying to find a way to password protect an Excel file (.xlsm) beyond the built-in password encryption options.
Ideally:
Enter the password
File works for a week(/other period of time)
After a ...
- 33
1
vote
1
answer
2k
views
OpenTSA and PKCS11
We are planning to implement the time-stamping service (RFC 3161) using OpenTSA and we wanted to know:
Does OpenTSA support PKCS #11 (Cryptoki) to talk to HSMs?
BTW: I did not find documentation or ...
- 121
-2
votes
1
answer
1k
views
Prevent Replay attacks via timestamp while client clock is not adjusted [closed]
I'm going to send my timestamp to server and server will check if it is in a given interval. What if My mobile clock is not adjusted (say it gives 2:00 pm while now it is 2:00 am). now I lost the ...
- 103
4
votes
2
answers
22k
views
How to know when a file was deleted in a NTFS filesystem?
Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
- 2,789
1
vote
2
answers
188
views
Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate?
There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
user47733
14
votes
6
answers
12k
views
What is the most credible timestamp I can create for a digital file?
Is it possible to create a timestamp that is so hard to fake, that it could be used as proof or simply strong evidence in a court of law, that something was not created after a certain point in time?
...
- 300
4
votes
2
answers
327
views
How can I validate time-sensitive data is coming from a mobile app, and not being forged?
In our application, a user selects answers to questions. Their score is based on the time spent answering each question down to a tenth of a second. The server is responsible for calculating and ...
- 141
1
vote
1
answer
660
views
Is long-term validity definitively corrupted upon TSA certificate revocation?
Suppose a document that was signed with a long-term signature (e.g. CAdES-A): D S T1 (D - document, S - signature, T1 - time-stamp created using a time-stamping certificate C1).
If C1 appears in the ...
- 143
3
votes
1
answer
1k
views
How to handle CRLs correctly in long-term electronic signatures?
What is a recommended way of handling CRLs in long-term electronic signatures (specifically the CAdES-A)?
The problem I see is in that CRLs are not protected against modification (they are plain text, ...
- 143
5
votes
1
answer
3k
views
How is an Authenticode timestamp verified?
For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed ...
- 2,128
1
vote
1
answer
965
views
Why is ICMP timestamping disabled on OS X?
It would seem like ICMP timestamping is quite a useful feature for troubleshooting networks with asymmetric paths.
Replies to icmp(4) timestamp requests are generated by the kernel:
On OpenBSD, the ...
- 1,984
5
votes
1
answer
3k
views
Is there any functional distributed timestamp server available? If not what about this homebrew solution?
Objective
A secure Arrow of Time with unpredictable future behaviour to stop attackers or DDoS BotNets from pre-calculating proof-of-work and other gateway protections for P2P/F2F. A distributed ...
- 5,253
2
votes
1
answer
4k
views
Expiring Decryption Key
So, I'm just a programmer -- I don't know much about cryptography so bare with me and my lack of knowledge in this realm.
But essentially, I'm wanting to cache data that could be potentially volatile (...
- 55
5
votes
1
answer
1k
views
Trusted Timestamping Scope and Real-World Uses
What security assurances does Trusted Timestamping based on Cryotography provide?
What are the real-world uses of Trusted Timestamping?
- 153
6
votes
2
answers
3k
views
What are the real-time applications of long term digital signature with timestamp
I want to know the real time applications that uses digital signatures with timestamps. Specially I am interested to know the applications where we can trust an old signed document which is now ...
- 61
5
votes
4
answers
6k
views
How to sign & timestamp log or zip files?
I think I can easily sign the files however I also need a timestamp from 3rd party vendor. I want to digitally sign + stamp log files including DHCP & mail because of laws here.
UPDATE: I found ...
- 151
3
votes
1
answer
744
views
Signature and Timestamp for Long Term Document Archival Question
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.
As far as I understand, I ...
- 131