49

In general, the problem of Secure Timestamping is actually a complex topic with no single right answer. There are two general approaches: 1) a trusted "Timestamping Authority" keeps logs of when stuff happened and everybody believes them because that's literally their job. 2) Using cryptography in some way. In general the crypto approaches don't work very ...


39

If all parties can trust a common randomness beacon (like the NIST Randomness Beacon), this can be achieved by including a recent block from the beacon into the file along with its timestamp. The recipients then, in addition to verifying the signature, must also verify that the beacon data is authentic and as recent as they require. Other public random ...


34

You can use the Bitcoin (or similar) blockchain for that. Create a file with both your original file (in case of text it can be inline, otherwise use a container like a ZIP archive) as well as a message stating who you are and that you have a copy of the file. Take the SHA1 of the resulting file/container and use it as a Bitcoin address to send some coins ...


17

Yes - if the person you want to prove it to trusts the service not change the timestamps. This is an excellent question - one that has been asked and answered, in various forms, since at least Galileo's time: Early astronomers used anagrams [...] to lay claim to new discoveries before their results were ready for publication. Galileo used ...


15

During the handshake, the client and server send each other "random values", which are sequences of 32 random bytes. The "client random" is part of the ClientHello message, while the "server random" is part of the ServerHello message. In both cases, the first four bytes of the random value encode the current date and time (number of seconds since January ...


12

Just last week I heard of this Proof of Existence service that makes a secure digest of your file and gets it added to the public Bitcoin blockchain. So henceforth and forevermore (or until Bitcoin is cracked or abandoned), you'll have publicly-certified, publicly-verifiable proof that THAT particular instance of your file existed at that time. Even if the ...


11

First things first. What's the problem you are trying to solve ? What is the attack model ? We cannot tell whether a protocol achieves a given goal if the said goal has not been given. Apparently, you are dissatisfied with Time Stamp Authorities as they are commonly used. Let's see what TSA do and on what security property they rely. A TSA emits time ...


11

There is no single way to mitigate time spoofing attacks. However, getting time information from several sources and ensuring none of the sources too strongly disagree with each other is a start. NTP The Network Time Protocol, with the common version 3 specified in RFC 1305, is the most widely used and most well known method of getting time. It is an ...


7

A certificate for a Time Stamp Authority is accepted as such only if it contains an Extended Key Usage extension which itself advertises the specific id-kp-timeStamping object identifier (aka 1.3.6.1.5.5.7.3.8). Though Authenticode time stamps do not follow the RFC 3161 format, the rules on the TSA certificate are still the same (see section 2.3). There is ...


6

I think you could use any web site operated by a reputable company that supports access over SSL. The one quirk is that the list of certificate authorities that might sign their certificate could change. For example if you retrieve https://www.google.com/ you'll get something like: HTTP/1.0 200 OK Date: Tue, 06 Dec 2011 17:02:40 GMT Expires: -1 Cache-...


6

Trusted timestamps You can use a trusted timestamp service. There are companies (such as GlobalSign) that will provide that service for a fee. But this is silly, as anyone could record these hashes by hitting the server often enough. Yes. But only if you have a small search space. But in the case of SHA256 there you would have to devote 10^77 rows in ...


6

The disadvantage would be that the TCP sequence could wrap. This is a risk on very high speed networks. You can randomize the initial timestamp, however, just as you asked. It's a very simple patch, so any rejects will be trivial to fix. It requires the grsecurity patchset to already be applied. From https://grsecurity.net/~spender/random_timestamp.diff: ...


6

Each encryption mode has its requirements for the IV. For GCM, the requirements are simple (see NIST SP 800-38D for details): Length should be between 1 and 261-1 bytes. It is recommended that the IV length is exactly 12 bytes (96 bits); if it is not, then GCM will need to pad and/or hash the IV first, which is not supported by all implementations, and ...


5

Digital signatures "expire" because a signature is performed with a private key and verified against the corresponding public key. The public key is linked to an identity (e.g. a legally defined individual) through certificates. The usual standard for certificates (X.509) specifies that certificates expire. Beyond the expiration date, the certificate shall ...


5

This is why Microsoft recommends to never remove expired code signing certs from CRLs. An alternative scenario: attacker signs their malware before cert expiry. If they can remain undiscovered past cert expiry, then the cert won't get added to the CRL even on discovery, and their malware will never get blocked. Thus the revocation status of code signing ...


5

Looks like i was almost at it and briefly misunderstood the concept used. The concept i assumed was the database version of timestamping, mainly because of the list on the website (yes, there are different methods of timestamping - see here), while actually the PKI one is being used according to RFC 3161. The concept can be more easily explained by this ...


4

If you are ready to make an explicit request every time you want a signed time token, then you may as well request a regular time stamp. There are a number of free time stamping services around here, operated by CA for use with Authenticode. For instance, at that URL: http://timestamp.globalsign.com/scripts/timstamp.dll there appears to be a TSA which runs ...


4

A CRL is a signed object, just like a certificate. This is why they need not be covered by the actual document signature. However, for long-term archival, they need to be timestamped. The theoretical background is the following: At a given time T, you may validate certificates and verify signatures by using just-downloaded CRL, which give guarantee about ...


4

Time stamping is meant to provide a verifiable proof that a given piece of data "existed" at some past date. One widespread time stamping protocol is described in RFC 3161: technically, the TSA (Time Stamping Authority) computes a digital signature on a structure which includes the current date (at the time of signature, as known by the TSA) and a hash value ...


4

Regardless of what is contained in the paper a standard ntp request datagram does contain a timestamp that represents the time the datagram was sent. From page 22 of the RFC: Origin Timestamp (org): Time at the client when the request departed for the server, in NTP timestamp format. The answer to the question "Does ntp leak system time?" is "Yes. A ...


4

It's impossible to protect some file for some time. Intrinsically, the file doesn't have any property that will allow it to know whether it's January, 1st, 2010 or 30-Feb-2050 (if February will have 30 days in 2050). What "could" know the time is the program opening it. In your case, Excel. But a program itself doesn't know about time either. It would need ...


4

A file is just a collection of bytes. It cannot do something to itself on its own. You need an access restricting application, or use what is available. Because it is an excel document, any weird solution you come up with can be circumvented just by saving it locally unprotected or copy pasting. But if you still want to at least try, even if it isn't ...


4

Dealing with digital signatures is more complex than we can suppose at first sight. Your scenario is correct: if you do not have a proof of the date/time of the signature you cannot be sure it has not been done after the revocation and expiration of the certificate. You can also note that, even if the certificate has not been revoked, a signature done after ...


4

You can put the hash of your commit into Bitcoin blockchain, and after some blocks added upon the block having your hash, you will be able to convince people that you had had that commit prior the time the block has been added into the blockchain.


4

None will protect against a replay attact. In the first case, all the attacker has to do is adjust the timestamp. In the second case, since H() is not supposed to be secret and since the timestamp is known, and attacker can also adjust the request by creating a valid H(timestamp). There is also the problem that you need to synchronize the client and ...


4

Windows 7 doesn't support SHA256 signatures by default. You need to apply this update, in order to get the desired functionality.


4

As of Linux kernel commit 95a22caee396cef0bb2ca8fafdd82966a49367bb, all TCP timestamps are randomized. This allows you to mitigate clock skew fingerprinting without worrying about the issues that can arise on high-throughput connections when timestamps are disabled. Note that this commit was partially reverted due to breakages, but TCP timestamps are still ...


3

You cannot always get an exact answer in forensics. Sometimes the result is a time range of possibility. That said, you can get exact answers sometimes. For your scenario, it depends on what version of Windows was used to create and maintain this volume. NTFS has long supported journaling (short term logging) in the file named $LogFile in the root of ...


3

When a certificate is revoked, the CRL contains the revocation date which tells at which date the certificate became "invalid". Indirectly, it specifies that the certificate was fine up to that date. For instance, if a private key is compromised after a burglary, the security camera recordings will be used to determine at which hour the key was stolen, and ...


3

No, the paper means something else. The paper talks about connecting multiple times to the same Tor Hidden service to increase the load, and at the same time measuring clock skew from candidate IP addresses. If the candidate shows clock skew during the attack, the server can be identified.


Only top voted, non community-wiki answers of a minimum length are eligible