49 votes

How to prove a picture was taken before a certain date?

In general, the problem of Secure Timestamping is actually a complex topic with no single right answer. There are two general approaches: 1) a trusted "Timestamping Authority" keeps logs of when stuff ...
Mike Ounsworth's user avatar
39 votes
Accepted

How to prove that a file was not created in advance

If all parties can trust a common randomness beacon (like the NIST Randomness Beacon), this can be achieved by including a recent block from the beacon into the file along with its timestamp. The ...
Luis Casillas's user avatar
34 votes

How to prove a picture was taken before a certain date?

You can use the Bitcoin (or similar) blockchain for that. Create a file with both your original file (in case of text it can be inline, otherwise use a container like a ZIP archive) as well as a ...
André Borie's user avatar
  • 12.8k
17 votes

How to prove a picture was taken before a certain date?

Yes - if the person you want to prove it to trusts the service not change the timestamps. This is an excellent question - one that has been asked and answered, in various forms, since at least ...
watchowl's user avatar
  • 5,458
12 votes
Accepted

Mitigate Time Spoofing Attack

There is no single way to mitigate time spoofing attacks. However, getting time information from several sources and ensuring none of the sources too strongly disagree with each other is a start. NTP ...
forest's user avatar
  • 66.7k
8 votes
Accepted

How do systems protect against a stolen code-signing certificate after the certificate expires?

This is why Microsoft recommends to never remove expired code signing certs from CRLs. An alternative scenario: attacker signs their malware before cert expiry. If they can remain undiscovered past ...
wmjdgla's user avatar
  • 196
8 votes
Accepted

Could I use a TimeStamp also as IV?

Each encryption mode has its requirements for the IV. For GCM, the requirements are simple (see NIST SP 800-38D for details): Length should be between 1 and 261-1 bytes. It is recommended that the IV ...
Tom Leek's user avatar
  • 173k
5 votes
Accepted

SHA-256 Timestamp not recognized in windows 7 when dual signed

Windows 7 doesn't support SHA256 signatures by default. You need to apply this update, in order to get the desired functionality.
bayo's user avatar
  • 687
5 votes

Pros and cons of disabling TCP timestamps

The disadvantage would be that the TCP sequence could wrap. This is a risk on very high speed networks. You can randomize the initial timestamp, however, just as you asked. It's a very simple patch, ...
forest's user avatar
  • 66.7k
5 votes
Accepted

Timestamp vs Replay attack

None will protect against a replay attact. In the first case, all the attacker has to do is adjust the timestamp. In the second case, since H() is not supposed to be secret and since the timestamp ...
Stephane's user avatar
  • 18.7k
5 votes
Accepted

Signing and timestamping implementation

So, in general, your thought process is correct. Create the digital content Document and save it. To prove that Author last saved Document they would sign the file with their asymetric key To prove ...
Ruscal's user avatar
  • 851
4 votes

Any Known countermeasures against clock skew fingerprinting?

As of Linux kernel commit 95a22caee396cef0bb2ca8fafdd82966a49367bb, all TCP timestamps are randomized. This allows you to mitigate clock skew fingerprinting without worrying about the issues that can ...
forest's user avatar
  • 66.7k
4 votes

Pros and cons of disabling TCP timestamps

linux: no more kernel patches. On newer kernels, you can use net.ipv4.tcp_timestamps = 1 Enable timestamps as defined in RFC1323 and use random offset for each connection rather than only using ...
Massimo's user avatar
  • 141
4 votes

What is the purpose of JSON Web Token (JWS)'s issued at "iat" field?

What is the purpose of the "iat" field? For example, why would one want to determine the age of a JWT? Were there specific purposes in mind when the spec was created? "iat" can ...
HTKLee's user avatar
  • 1,852
4 votes

Is it possible to verifiably timestamp a video?

You mention surveillance cameras as one possible application, and I assume you want its footage to hold up in court, but for that it usually does not need to be accurate to a single frame (with dozens ...
Luc's user avatar
  • 32.9k
4 votes

Is it safe to assume that my computer's clock will always be synced with actual time within the second or a few seconds at the worst?

No, in general. Time keeping is an important part of the kernel's duties, but it's not infallible, especially when you're talking about scenarios where other failures are occurring. In general you ...
David's user avatar
  • 1,416
4 votes

Proving that a file existed at a time

As @user mentions, there have been public services for this pretty much since the beginning of the internet; they are called Time Stamping Authorities (TSAs). From a quick google search shows that ...
Mike Ounsworth's user avatar
3 votes
Accepted

Why timestamping chain is better than "code signature" chain?

Timestamping is a special kind of signature already. TS = Sign(Hash(info | X) | time) The renewal is : TS' = Sign(Hash(TS | info) | time) Of course, you could sign the original info with the new ...
M'vy's user avatar
  • 13.1k
3 votes

Is RFC 3161 necessary?

Probably not. See this for an example of the fragility of such a scheme: Did the Twitter account Fifndhs predict the exact World Cup results ahead of time? The account tweeted the ...
GnP's user avatar
  • 2,299
3 votes

Can setting the date on your iPhone to the epoch really brick it?

It's real, sadly. From Wired article: The bug appears to only affect 64-bit iOS devices, meaning iPhone 5S, iPad Air, and iPad Mini 2 and newer are affected. It’s almost certainly related to the ...
Mark Buffalo's user avatar
  • 22.6k
3 votes

How to extract TSA certificate from tst file?

You can get embedded certificates in you timestamp token with the command : openssl pkcs7 -inform der -in token.tst -print_certs | sed -n '/-----BEGIN/,/-----END/p' > chain.pem Or if you deals ...
fred727's user avatar
  • 131
3 votes

How to extract TSA certificate from tst file?

I was having trouble with this too. In addition to the other answers, I found a mailing list post that says the following: Looking at the TS code in OpenSSL, it seems that the peer's chain is not ...
Ryan J's user avatar
  • 131
3 votes
Accepted

Does x509 have an "issued at" timestamp? Can you tell when an x509 certificate was issued?

X.509 has a Not Before and a Not After field which describes when the certificate is valid to use for the defined purpose. The Not Before usually matches about the time when the certificate was issued ...
Steffen Ullrich's user avatar
3 votes
Accepted

Do any third party time stamping signature services exist?

A line from a build script I used a few years ago: signtool sign /v /f <REDACTED> /p <REDACTED> /fd sha256 /t http://timestamp.verisign.com/scripts/timstamp.dll %1 That is, using the ...
CBHacking's user avatar
  • 48.4k
3 votes

Is it possible to track someone by sharing a youtube link with timestamp?

Practical answer Unless they are in YouTube's servers, there is no way for someone to track what you do if you click a link with a timestamp. If they are sniffing your HTTPS traffic, all they will ...
Delya Erricson's user avatar
2 votes

Different Microsoft-signed excecutables have apparently the same signature!

Some questions can be answered, other are speculative. X.509 relies on ASN.1. ASN.1 defines two data types for dates, UTCTime and GeneralizedTime. UTCTime has only two digits for the year, so it is ...
Tom Leek's user avatar
  • 173k
2 votes
Accepted

How to put the "trust" into trusted-timestamping

I'm assuming your thesis is done by now (hopefully), but for historical purposes and for future readers I'll still provide an answer. Below is link to an academic paper on the topic of Bitcoin based ...
ilikebeets's user avatar
  • 2,906
2 votes

How to prove that something happened before some time in a distributed way?

This has been discussed in more detail here: Is there any functional distributed timestamp server available? If not what about this homebrew solution? https://en.wikipedia.org/wiki/...
Navin's user avatar
  • 465
2 votes
Accepted

Can a time stamp protect a signature with the obsolete SHA1?

Collisions do not threaten existing signatures. A collision means the attacker has the ability to create/modify both of the inputs to create colliding hashes. The attacker obviously can't create or ...
Xander's user avatar
  • 35.8k

Only top scored, non community-wiki answers of a minimum length are eligible