blog/Public_Trusted_Timestamping_services_for_everyone.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: Public Trusted Timestamping services for everyone</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9
  10
  11   </head>
  12   <body>
  13     <div class="title">
  14  <h1>
  15      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  16
  17  </h1>
  18
  19 </div>
  20
  21
  22     <div class="entry">
  23       <div class="title">Public Trusted Timestamping services for everyone</div>
  24       <div class="date">25th March 2014</div>
  25       <div class="body"><p>Did you ever need to store logs or other files in a way that would
  26 allow it to be used as evidence in court, and needed a way to
  27 demonstrate without reasonable doubt that the file had not been
  28 changed since it was created?  Or, did you ever need to document that
  29 a given document was received at some point in time, like some
  30 archived document or the answer to an exam, and not changed after it
  31 was received?  The problem in these settings is to remove the need to
  32 trust yourself and your computers, while still being able to prove
  33 that a file is the same as it was at some given time in the past.</p>
  34
  35 <p>A solution to these problems is to have a trusted third party
  36 "stamp" the document and verify that at some given time the document
  37 looked a given way.  Such
  38 <a href="https://en.wikipedia.org/wiki/Notarius">notarius</a> service
  39 have been around for thousands of years, and its digital equivalent is
  40 called a
  41 <a href="http://en.wikipedia.org/wiki/Trusted_timestamping">trusted
  42 timestamping service</a>.  <a href="http://www.ietf.org/">The Internet
  43 Engineering Task Force</a> standardised how such service could work a
  44 few years ago as <a href="http://tools.ietf.org/html/rfc3161">RFC
  45 3161</a>.  The mechanism is simple.  Create a hash of the file in
  46 question, send it to a trusted third party which add a time stamp to
  47 the hash and sign the result with its private key, and send back the
  48 signed hash + timestamp.  Both email, FTP and HTTP can be used to
  49 request such signature, depending on what is provided by the service
  50 used. Anyone with the document and the signature can then verify that
  51 the document matches the signature by creating their own hash and
  52 checking the signature using the trusted third party public key.
  53 There are several commercial services around providing such
  54 timestamping.  A quick search for
  55 "<a href="https://duckduckgo.com/?q=rfc+3161+service">rfc 3161
  56 service</a>" pointed me to at least
  57 <a href="https://www.digistamp.com/technical/how-a-digital-time-stamp-works/">DigiStamp</a>,
  58 <a href="http://www.quovadisglobal.co.uk/CertificateServices/SigningServices/TimeStamp.aspx">Quo
  59 Vadis</a>,
  60 <a href="https://www.globalsign.com/timestamp-service/">Global Sign</a>
  61 and <a href="http://www.globaltrustfinder.com/TSADefault.aspx">Global
  62 Trust Finder</a>.  The system work as long as the private key of the
  63 trusted third party is not compromised.</p>
  64
  65 <p>But as far as I can tell, there are very few public trusted
  66 timestamp services available for everyone.  I've been looking for one
  67 for a while now. But yesterday I found one over at
  68 <a href="https://www.pki.dfn.de/zeitstempeldienst/">Deutches
  69 Forschungsnetz</a> mentioned in
  70 <a href="http://www.d-mueller.de/blog/dealing-with-trusted-timestamps-in-php-rfc-3161/">a
  71 blog by David Müller</a>.  I then found
  72 <a href="http://www.rz.uni-greifswald.de/support/dfn-pki-zertifikate/zeitstempeldienst.html">a
  73 good recipe on how to use the service</a> over at the University of
  74 Greifswald.</p>
  75
  76 <p><a href="http://www.openssl.org/">The OpenSSL library</a> contain
  77 both server and tools to use and set up your own signing service.  See
  78 the ts(1SSL), tsget(1SSL) manual pages for more details.  The
  79 following shell script demonstrate how to extract a signed timestamp
  80 for any file on the disk in a Debian environment:</p>
  81
  82 <p><blockquote><pre>
  83 #!/bin/sh
  84 set -e
  85 url="http://zeitstempel.dfn.de"
  86 caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt"
  87 reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq)
  88 resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr)
  89 cafile=chain.txt
  90 if [ ! -f $cafile ] ; then
  91     wget -O $cafile "$caurl"
  92 fi
  93 openssl ts -query -data "$1" -cert | tee "$reqfile" \
  94     | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile"
  95 openssl ts -reply -in "$resfile" -text 1>&2
  96 openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2
  97 base64 < "$resfile"
  98 rm "$reqfile" "$resfile"
  99 </pre></blockquote></p>
 100
 101 <p>The argument to the script is the file to timestamp, and the output
 102 is a base64 encoded version of the signature to STDOUT and details
 103 about the signature to STDERR.  Note that due to
 104 <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742553">a bug
 105 in the tsget script</a>, you might need to modify the included script
 106 and remove the last line.  Or just write your own HTTP uploader using
 107 curl. :) Now you too can prove and verify that files have not been
 108 changed.</p>
 109
 110 <p>But the Internet need more public trusted timestamp services.
 111 Perhaps something for <a href="http://www.uninett.no/">Uninett</a> or
 112 my work place the <a href="http://www.uio.no/">University of Oslo</a>
 113 to set up?</p>
 114 </div>
 115
 116       <div class="tags">Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.</div>
 117
 118
 119     </div>
 120
 121
 122
 123
 124     <div id="sidebar">
 125
 126
 127
 128 <h2>Archive</h2>
 129 <ul>
 130
 131 <li>2015
 132 <ul>
 133
 134 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/01/">January (7)</a></li>
 135
 136 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/02/">February (6)</a></li>
 137
 138 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/03/">March (1)</a></li>
 139
 140 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/04/">April (4)</a></li>
 141
 142 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/05/">May (3)</a></li>
 143
 144 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/06/">June (4)</a></li>
 145
 146 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/07/">July (6)</a></li>
 147
 148 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/08/">August (2)</a></li>
 149
 150 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/09/">September (2)</a></li>
 151
 152 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/10/">October (2)</a></li>
 153
 154 </ul></li>
 155
 156 <li>2014
 157 <ul>
 158
 159 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/01/">January (2)</a></li>
 160
 161 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/02/">February (3)</a></li>
 162
 163 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/03/">March (8)</a></li>
 164
 165 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/04/">April (7)</a></li>
 166
 167 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/05/">May (1)</a></li>
 168
 169 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/06/">June (2)</a></li>
 170
 171 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/07/">July (2)</a></li>
 172
 173 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/08/">August (2)</a></li>
 174
 175 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/09/">September (5)</a></li>
 176
 177 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/10/">October (6)</a></li>
 178
 179 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/11/">November (3)</a></li>
 180
 181 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/12/">December (5)</a></li>
 182
 183 </ul></li>
 184
 185 <li>2013
 186 <ul>
 187
 188 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
 189
 190 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
 191
 192 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
 193
 194 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
 195
 196 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
 197
 198 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
 199
 200 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
 201
 202 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
 203
 204 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/09/">September (5)</a></li>
 205
 206 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/10/">October (7)</a></li>
 207
 208 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/11/">November (9)</a></li>
 209
 210 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/12/">December (3)</a></li>
 211
 212 </ul></li>
 213
 214 <li>2012
 215 <ul>
 216
 217 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
 218
 219 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
 220
 221 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
 222
 223 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
 224
 225 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
 226
 227 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
 228
 229 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
 230
 231 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
 232
 233 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
 234
 235 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
 236
 237 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
 238
 239 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
 240
 241 </ul></li>
 242
 243 <li>2011
 244 <ul>
 245
 246 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
 247
 248 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
 249
 250 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
 251
 252 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
 253
 254 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
 255
 256 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
 257
 258 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
 259
 260 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
 261
 262 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
 263
 264 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
 265
 266 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
 267
 268 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
 269
 270 </ul></li>
 271
 272 <li>2010
 273 <ul>
 274
 275 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 276
 277 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 278
 279 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 280
 281 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 282
 283 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 284
 285 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 286
 287 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 288
 289 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
 290
 291 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
 292
 293 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
 294
 295 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
 296
 297 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
 298
 299 </ul></li>
 300
 301 <li>2009
 302 <ul>
 303
 304 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 305
 306 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 307
 308 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 309
 310 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 311
 312 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 313
 314 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 315
 316 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 317
 318 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 319
 320 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 321
 322 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 323
 324 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 325
 326 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 327
 328 </ul></li>
 329
 330 <li>2008
 331 <ul>
 332
 333 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 334
 335 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 336
 337 </ul></li>
 338
 339 </ul>
 340
 341
 342
 343 <h2>Tags</h2>
 344 <ul>
 345
 346  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
 347
 348  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 349
 350  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 351
 352  <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
 353
 354  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (8)</a></li>
 355
 356  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (15)</a></li>
 357
 358  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
 359
 360  <li><a href="http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (2)</a></li>
 361
 362  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (112)</a></li>
 363
 364  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (153)</a></li>
 365
 366  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (10)</a></li>
 367
 368  <li><a href="http://people.skolelinux.org/pere/blog/tags/dld">dld (15)</a></li>
 369
 370  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (18)</a></li>
 371
 372  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
 373
 374  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (289)</a></li>
 375
 376  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (23)</a></li>
 377
 378  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
 379
 380  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (20)</a></li>
 381
 382  <li><a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (9)</a></li>
 383
 384  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (16)</a></li>
 385
 386  <li><a href="http://people.skolelinux.org/pere/blog/tags/h264">h264 (20)</a></li>
 387
 388  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (42)</a></li>
 389
 390  <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (10)</a></li>
 391
 392  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (19)</a></li>
 393
 394  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (9)</a></li>
 395
 396  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (8)</a></li>
 397
 398  <li><a href="http://people.skolelinux.org/pere/blog/tags/lsdvd">lsdvd (2)</a></li>
 399
 400  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 401
 402  <li><a href="http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (8)</a></li>
 403
 404  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (36)</a></li>
 405
 406  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (265)</a></li>
 407
 408  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (177)</a></li>
 409
 410  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (20)</a></li>
 411
 412  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
 413
 414  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (53)</a></li>
 415
 416  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (87)</a></li>
 417
 418  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
 419
 420  <li><a href="http://people.skolelinux.org/pere/blog/tags/reactos">reactos (1)</a></li>
 421
 422  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
 423
 424  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (3)</a></li>
 425
 426  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (9)</a></li>
 427
 428  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 429
 430  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
 431
 432  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
 433
 434  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (42)</a></li>
 435
 436  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
 437
 438  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (4)</a></li>
 439
 440  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (48)</a></li>
 441
 442  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (3)</a></li>
 443
 444  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (10)</a></li>
 445
 446  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (34)</a></li>
 447
 448  <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (2)</a></li>
 449
 450  <li><a href="http://people.skolelinux.org/pere/blog/tags/usenix">usenix (2)</a></li>
 451
 452  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (8)</a></li>
 453
 454  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (54)</a></li>
 455
 456  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
 457
 458  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (37)</a></li>
 459
 460 </ul>
 461
 462
 463     </div>
 464     <p style="text-align: right">
 465  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
 466 </p>
 467
 468   </body>
 469 </html>