- <div class="entry">
- <div class="title"><a href="http://people.skolelinux.org/pere/blog/Fetching_trusted_timestamps_using_the_rfc3161ng_python_module.html">Fetching trusted timestamps using the rfc3161ng python module</a></div>
- <div class="date"> 8th October 2018</div>
- <div class="body"><p>I have earlier covered the basics of trusted timestamping using the
-'openssl ts' client. See blog post for
-<a href="http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html">2014</a>,
-<a href="http://people.skolelinux.org/pere/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html">2016</a>
-and
-<a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_trusted_timestamps_in_a_Noark_5_archive.html">2017</a>
-for those stories. But some times I want to integrate the timestamping
-in other code, and recently I needed to integrate it into Python.
-After searching a bit, I found
-<a href="https://dev.entrouvert.org/projects/python-rfc3161">the
-rfc3161 library</a> which seemed like a good fit, but I soon
-discovered it only worked for python version 2, and I needed something
-that work with python version 3. Luckily I next came across
-<a href="https://github.com/trbs/rfc3161ng/">the rfc3161ng library</a>,
-a fork of the original rfc3161 library. Not only is it working with
-python 3, it have fixed a few of the bugs in the original library, and
-it has an active maintainer. I decided to wrap it up and make it
-<a href="https://tracker.debian.org/pkg/python-rfc3161ng">available in
-Debian</a>, and a few days ago it entered Debian unstable and testing.</p>
-
-<p>Using the library is fairly straight forward. The only slightly
-problematic step is to fetch the required certificates to verify the
-timestamp. For some services it is straight forward, while for others
-I have not yet figured out how to do it. Here is a small standalone
-code example based on of the integration tests in the library code:</p>
-
-<pre>
-#!/usr/bin/python3
-
-"""
-
-Python 3 script demonstrating how to use the rfc3161ng module to
-get trusted timestamps.
-
-The license of this code is the same as the license of the rfc3161ng
-library, ie MIT/BSD.
-
-"""
-
-import os
-import pyasn1.codec.der
-import rfc3161ng
-import subprocess
-import tempfile
-import urllib.request
-
-def store(f, data):
- f.write(data)
- f.flush()
- f.seek(0)
-
-def fetch(url, f=None):
- response = urllib.request.urlopen(url)
- data = response.read()
- if f:
- store(f, data)
- return data
-
-def main():
- with tempfile.NamedTemporaryFile() as cert_f,\
- tempfile.NamedTemporaryFile() as ca_f,\
- tempfile.NamedTemporaryFile() as msg_f,\
- tempfile.NamedTemporaryFile() as tsr_f:
-
- # First fetch certificates used by service
- certificate_data = fetch('https://freetsa.org/files/tsa.crt', cert_f)
- ca_data_data = fetch('https://freetsa.org/files/cacert.pem', ca_f)
-
- # Then timestamp the message
- timestamper = \
- rfc3161ng.RemoteTimestamper('http://freetsa.org/tsr',
- certificate=certificate_data)
- data = b"Python forever!\n"
- tsr = timestamper(data=data, return_tsr=True)
-
- # Finally, convert message and response to something 'openssl ts' can verify
- store(msg_f, data)
- store(tsr_f, pyasn1.codec.der.encoder.encode(tsr))
- args = ["openssl", "ts", "-verify",
- "-data", msg_f.name,
- "-in", tsr_f.name,
- "-CAfile", ca_f.name,
- "-untrusted", cert_f.name]
- subprocess.check_call(args)
-
-if '__main__' == __name__:
- main()
-</pre>
-
-<p>The code fetches the required certificates, store them as temporary
-files, timestamp a simple message, store the message and timestamp to
-disk and ask 'openssl ts' to verify the timestamp. A timestamp is
-around 1.5 kiB in size, and should be fairly easy to store for future
-use.</p>
-
-<p>As usual, if you use Bitcoin and want to show your support of my
-activities, please send Bitcoin donations to my address
-<b><a href="bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b">15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b</a></b>.</p>
-</div>
- <div class="tags">
-
-
- Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
-
-
- </div>
- </div>
- <div class="padding"></div>
-
projects / homepage.git / blobdiff