Questions tagged [timestamp]

For questions relating to physical or digital timestamps, usually as part of a cryptographic protocol, logging, or auditing requirement. Please use the tag [time] for questions relating to system clocks.

Filter by
Sorted by
Tagged with
39 votes
2 answers
3k views

How to prove that a file was not created in advance

Sometimes we need to prove that a file was not created in advance - a good example is warrant canaries. The person releasing them may have been forced to sign the file with a future timestamp. For ...
Samuel Shifterovich's user avatar
38 votes
9 answers
26k views

How to prove a picture was taken before a certain date? [duplicate]

I need to prove that all my pictures were taken before a certain date. Is uploading them to Picassa, Flickr or a similar service a good way to achieve such timestamping?
nadia's user avatar
  • 413
19 votes
3 answers
38k views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
Parthian Shot's user avatar
16 votes
2 answers
11k views

What is the purpose of JSON Web Token (JWS)'s issued at "iat" field?

RFC 7519 specifies an optional "iat" field, indicating when a token was issued. The RFC provides a terse commentary: This claim can be used to determine the age of the JWT. What is the ...
jtpereyda's user avatar
  • 1,600
14 votes
6 answers
12k views

What is the most credible timestamp I can create for a digital file?

Is it possible to create a timestamp that is so hard to fake, that it could be used as proof or simply strong evidence in a court of law, that something was not created after a certain point in time? ...
Dom's user avatar
  • 300
13 votes
2 answers
16k views

TLS reliance on System Time

I'm interested to know if there is any reliance on system time (as defined by Linux or windows) when initiating a secure handshake. I'm aware that TCP typically uses a random number (RFC 1323) to ...
Nark's user avatar
  • 549
11 votes
2 answers
4k views

How do systems protect against a stolen code-signing certificate after the certificate expires?

Imagine this scenario: 1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp. 15th December 2014 - the certificate is revoked. Malware will be prevented from ...
micro-maureen's user avatar
9 votes
3 answers
1k views

On-line cryptographically signed date/time?

I’m looking for a source of on-line cryptographically signed date/time. I do not need a full timestamp service, as I am happy with the information « date/time was that », without a link to a challenge/...
fgrieu's user avatar
  • 1,231
9 votes
4 answers
2k views

What good, standard digital signature / timestamp verification clients are widely or easily deployed?

I'm looking for a good way to publish data along with a digital signature (and ideally a timestamp) which is as easy as possible to verify via software run locally on public data. For example, imagine ...
nealmcb's user avatar
  • 20.8k
6 votes
1 answer
1k views

Mitigate Time Spoofing Attack

Say Alice receives synchronized time from Tina the timekeeper. Say Ted spoofs a GPS signal, fooling Tina about the current time. Tina sends this fake time to Alice. What can Alice do to avoid being ...
jtpereyda's user avatar
  • 1,600
6 votes
2 answers
3k views

What are the real-time applications of long term digital signature with timestamp

I want to know the real time applications that uses digital signatures with timestamps. Specially I am interested to know the applications where we can trust an old signed document which is now ...
Naveen Kumar's user avatar
5 votes
1 answer
3k views

Is there any functional distributed timestamp server available? If not what about this homebrew solution?

Objective A secure Arrow of Time with unpredictable future behaviour to stop attackers or DDoS BotNets from pre-calculating proof-of-work and other gateway protections for P2P/F2F. A distributed ...
LateralFractal's user avatar
5 votes
1 answer
3k views

How is an Authenticode timestamp verified?

For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed ...
Michael's user avatar
  • 2,138
5 votes
4 answers
6k views

How to sign & timestamp log or zip files?

I think I can easily sign the files however I also need a timestamp from 3rd party vendor. I want to digitally sign + stamp log files including DHCP & mail because of laws here. UPDATE: I found ...
Nime Cloud's user avatar
5 votes
1 answer
1k views

Verification of a timestamped PDF

I'm kinda new to the process of timestamping files to provide digital integrity. For testing purposes, i use tsa.safecreative.org for PDF files. Now i've signed a couple PDF files and if i open up ...
James Cameron's user avatar
5 votes
2 answers
2k views

Does x509 have an "issued at" timestamp? Can you tell when an x509 certificate was issued?

The JWT Spec (RFC 7519) has an issued at field ("iat"). Does x509 have any analogous value? I see a Validity field, but nothing else time related.
jtpereyda's user avatar
  • 1,600
5 votes
1 answer
695 views

Any Known countermeasures against clock skew fingerprinting?

I know lots of websites that do clock skew fingerprinting using tcp timestamps. I know how to disable timestamps but i want to know techniques that can be used to counter clock skew fingerprinting. I ...
jack's user avatar
  • 51
5 votes
1 answer
971 views

Trusted Timestamping Scope and Real-World Uses

What security assurances does Trusted Timestamping based on Cryotography provide? What are the real-world uses of Trusted Timestamping?
Chris Smith's user avatar
5 votes
1 answer
372 views

How to put the "trust" into trusted-timestamping

As a part of my thesis, I am about to evaluate different approaches to establish the trust in trusted-timestamping performed by a TSA (see RFC3161 - Trusted Timestamp Protocol). A trustworthy ...
Maximilian Beckmann's user avatar
5 votes
0 answers
306 views

What's the merit of storing LTV (long term validation) information for RFC3161 tokens and what happens if a TSA private key would leak?

I'll formulate my question in regards to timestamped PDF, but I wonder actually about the long term validation of RFC3161 tokens in general. So, PAdES has the concept of Long Term Validation, which ...
matthias_buehlmann's user avatar
5 votes
0 answers
3k views

Openssl cms verify signature with timestamp and crl

I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
saurabh's user avatar
  • 797
5 votes
1 answer
308 views

Random padding in hash functions

In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
Daniel H's user avatar
  • 153
4 votes
2 answers
22k views

How to know when a file was deleted in a NTFS filesystem?

Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
kinunt's user avatar
  • 2,799
4 votes
2 answers
314 views

How can I validate time-sensitive data is coming from a mobile app, and not being forged?

In our application, a user selects answers to questions. Their score is based on the time spent answering each question down to a tenth of a second. The server is responsible for calculating and ...
Logan Serman's user avatar
4 votes
1 answer
1k views

Issuing TSA (Time Stamping Authority) certificates

What is a practice for issuing TSA (Time Stamping Authority) certificates? I read that TSA certificates should be issued directly from Root CA, but basically TSA certificate is end entity certificate ...
user1563721's user avatar
  • 1,119
3 votes
5 answers
625 views

Proving an action was done at an exact time - a posteriori

I was thinking about the way git allows to edit the timestamp on commits, and how you can rewrite (public) history that way. I then drifted from that to "can we prove someone did an action at time X ...
Jiby's user avatar
  • 143
3 votes
5 answers
8k views

Password protect an excel file for a period of time? [closed]

I'm trying to find a way to password protect an Excel file (.xlsm) beyond the built-in password encryption options. Ideally: Enter the password File works for a week(/other period of time) After a ...
MotS's user avatar
  • 33
3 votes
2 answers
895 views

Could I use a TimeStamp also as IV?

For an academic application, I use AES-GCM to encrypt my frames between 2 parties. To enhance security, and reduce the possibility of replay, I'd like to use a TimeStamp in my frame exchanges. But, ...
3isenHeim's user avatar
  • 313
3 votes
4 answers
4k views

Is it possible to track someone by sharing a youtube link with timestamp?

Is it possible to track someone by sharing a youtube link with them with a timestamp such as &t=1s if they click on it on their end? I've recently have been told not to use timestamps because of ...
Joel Portillo's user avatar
3 votes
2 answers
871 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
adrelanos's user avatar
  • 764
3 votes
1 answer
6k views

SHA-256 Timestamp not recognized in windows 7 when dual signed

I wanted to dual sign my exe so that the XP and Vista users can use the software. But when i dual sign the exe with SHA1 and SHA256 timestamps, In windows7 only 1 timestamp is shown. To dual sign I ...
IT researcher's user avatar
3 votes
1 answer
420 views

Is code-signing with a non-ssl timestamp unsafe?

Assuming your code-signing tool is secure (e.g., does not suffer from buffer overflow exploits and the like), is there any reason to be concerned if a time-stamping service is not running over SSL? ...
Brian's user avatar
  • 962
3 votes
1 answer
1k views

How to handle CRLs correctly in long-term electronic signatures?

What is a recommended way of handling CRLs in long-term electronic signatures (specifically the CAdES-A)? The problem I see is in that CRLs are not protected against modification (they are plain text, ...
xarx's user avatar
  • 143
3 votes
2 answers
335 views

Can a time stamp protect a signature with the obsolete SHA1?

I am trying to figure out the scope of SHA1 deprecation for existent signatures. Reading this.An attacker (after 110 years) could present a fake document for a valid signature I believe this only ...
pedrofb's user avatar
  • 270
3 votes
1 answer
359 views

Is RFC 3161 necessary?

As I've been implementing RFC 3161 software components, I got to thinking about running my own TSA and how one really proves the integrity of a time stamp (preferably without violating patents). I ...
Chris's user avatar
  • 31
3 votes
1 answer
728 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
Petr's user avatar
  • 131
3 votes
1 answer
1k views

When would a Authenticode signature expire?

I'm curious about how Windows check the Authenticode signature. For example, I would sign test.exe I know that if test.exe doesn't have a TS (timestamp) signature from a TSA (Timestamp Authority)...
Jemmy1228's user avatar
  • 305
3 votes
0 answers
2k views

Verify PKCS#7 (CMS) detached signature with timestamp with OpenSSL

I have a PKCS#7 (i.e., CMS) detached signature of a file that is signed by my signing certificate and then timestamp signed by a TSA that is all generated by an application we wrote. I would like to ...
Hmmmmm's user avatar
  • 255
3 votes
0 answers
177 views

Is there a cryptographically secure way to verify the date of a process? [duplicate]

I have a few git repositories of content that will be updated constantly over the next decade. At some point down the road I anticipate being asked to prove that the content was actually in the state ...
Caleb's user avatar
  • 1,324
2 votes
4 answers
2k views

How to extract TSA certificate from tst file?

I have several timestamp token files that I think should have TSA certificates embedded within them because the "Request TSA certificate" option was selected when I requested them with TimeStampClient....
user273084's user avatar
2 votes
3 answers
2k views

Is it safe to assume that my computer's clock will always be synced with actual time within the second or a few seconds at the worst?

Years ago, I was running a service where the moderators were able to do various actions with massive privacy implications if the accounts or contributions were less than a short period of time. I did ...
Ned's user avatar
  • 21
2 votes
1 answer
632 views

Concatenating timestamp to data before encrypting it - is this a commonly used technique?

I have a web app that communicates with a backend server, and the users of the web app are organisations that each have a single login for the entire organisation. The app is meant to be used for ...
Magnus's user avatar
  • 243
2 votes
1 answer
580 views

Is a Fernet token's timestamp a security risk?

A Fernet token has the following format: Version ‖ Timestamp ‖ IV ‖ Ciphertext ‖ HMAC As the above shows, the timestamp is not part of the ciphertext, so anyone can read the time the token was made. ...
matsjoyce's user avatar
  • 125
2 votes
1 answer
230 views

Why can an expired certificate be used to sign a JAR file?

How does a timestamp prevent use of a leaked expired certificate to sign a malignant executable? If it is supposedly fine to share or leak expired certificates then why is it safe to allow use of such ...
Basilevs's user avatar
  • 121
2 votes
1 answer
825 views

Reliability of scanning tools on icmp timestamp responses

A security auditor has done a vulnerability scan of our network and found that one of our server has returned an TCP timestamp response such that the scanner (Nmap) is able to guess the uptime of the ...
JinPangPang's user avatar
  • 1,951
2 votes
1 answer
4k views

Expiring Decryption Key

So, I'm just a programmer -- I don't know much about cryptography so bare with me and my lack of knowledge in this realm. But essentially, I'm wanting to cache data that could be potentially volatile (...
Full Metal's user avatar
2 votes
1 answer
1k views

What's the PROPER way to validate a signature timestamp?

the purpose of adding trusted timestamps to signatures is so that they can be considered valid long beyond the validity of the signing certificate. However, this is not so easy, since TSA's signing ...
matthias_buehlmann's user avatar
2 votes
0 answers
162 views

Should I re-timestamp old timestamps when switching to a stronger algorithm?

One of our clients uses a trusted timestamp service to prove that certain documents existed on the day they were created (they don't need a full digital signature, just the timestamp). The server uses ...
Botond Balázs's user avatar
2 votes
3 answers
747 views

How to capture not only the mtime but also the ctime when making forensic copies of files?

Context I'm investigating a compromised Linux box where I found files with malicious code. The file system is too big to just make a copy of the whole block device and so far I'm only interested in ...
Axel Beckert's user avatar
1 vote
2 answers
194 views

How can Alice ping and authenticate Bob without any of them sharing their public keyes beforehand

Both hosts have just their public and private key pair (but they do not have the other party’s public key). Bob should be authenticated Assume that the two hosts share clocks that are synced, i.e ...
user avatar