I have earlier covered the basics of trusted timestamping using the
-'openssl ts' client. See blog post for
-2014,
-2016
-and
-2017
-for those stories. But some times I want to integrate the timestamping
-in other code, and recently I needed to integrate it into Python.
-After searching a bit, I found
-the
-rfc3161 library which seemed like a good fit, but I soon
-discovered it only worked for python version 2, and I needed something
-that work with python version 3. Luckily I next came across
-the rfc3161ng library,
-a fork of the original rfc3161 library. Not only is it working with
-python 3, it have fixed a few of the bugs in the original library, and
-it has an active maintainer. I decided to wrap it up and make it
-available in
-Debian, and a few days ago it entered Debian unstable and testing.
-
-
Using the library is fairly straight forward. The only slightly
-problematic step is to fetch the required certificates to verify the
-timestamp. For some services it is straight forward, while for others
-I have not yet figured out how to do it. Here is a small standalone
-code example based on of the integration tests in the library code:
-
-
-#!/usr/bin/python3
-
-"""
-
-Python 3 script demonstrating how to use the rfc3161ng module to
-get trusted timestamps.
-
-The license of this code is the same as the license of the rfc3161ng
-library, ie MIT/BSD.
-
-"""
-
-import os
-import pyasn1.codec.der
-import rfc3161ng
-import subprocess
-import tempfile
-import urllib.request
-
-def store(f, data):
- f.write(data)
- f.flush()
- f.seek(0)
-
-def fetch(url, f=None):
- response = urllib.request.urlopen(url)
- data = response.read()
- if f:
- store(f, data)
- return data
-
-def main():
- with tempfile.NamedTemporaryFile() as cert_f,\
- tempfile.NamedTemporaryFile() as ca_f,\
- tempfile.NamedTemporaryFile() as msg_f,\
- tempfile.NamedTemporaryFile() as tsr_f:
-
- # First fetch certificates used by service
- certificate_data = fetch('https://freetsa.org/files/tsa.crt', cert_f)
- ca_data_data = fetch('https://freetsa.org/files/cacert.pem', ca_f)
-
- # Then timestamp the message
- timestamper = \
- rfc3161ng.RemoteTimestamper('http://freetsa.org/tsr',
- certificate=certificate_data)
- data = b"Python forever!\n"
- tsr = timestamper(data=data, return_tsr=True)
-
- # Finally, convert message and response to something 'openssl ts' can verify
- store(msg_f, data)
- store(tsr_f, pyasn1.codec.der.encoder.encode(tsr))
- args = ["openssl", "ts", "-verify",
- "-data", msg_f.name,
- "-in", tsr_f.name,
- "-CAfile", ca_f.name,
- "-untrusted", cert_f.name]
- subprocess.check_call(args)
-
-if '__main__' == __name__:
- main()
-
-
-
The code fetches the required certificates, store them as temporary
-files, timestamp a simple message, store the message and timestamp to
-disk and ask 'openssl ts' to verify the timestamp. A timestamp is
-around 1.5 kiB in size, and should be fairly easy to store for future
-use.
-
-
As usual, if you use Bitcoin and want to show your support of my
-activities, please send Bitcoin donations to my address
-15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.
-
