blog/Public_Trusted_Timestamping_services_for_everyone.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: Public Trusted Timestamping services for everyone</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9
  10
  11   </head>
  12   <body>
  13     <div class="title">
  14  <h1>
  15      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  16
  17  </h1>
  18
  19 </div>
  20
  21
  22     <div class="entry">
  23       <div class="title">Public Trusted Timestamping services for everyone</div>
  24       <div class="date">25th March 2014</div>
  25       <div class="body"><p>Did you ever need to store logs or other files in a way that would
  26 allow it to be used as evidence in court, and needed a way to
  27 demonstrate without reasonable doubt that the file had not been
  28 changed since it was created?  Or, did you ever need to document that
  29 a given document was received at some point in time, like some
  30 archived document or the answer to an exam, and not changed after it
  31 was received?  The problem in these settings is to remove the need to
  32 trust yourself and your computers, while still being able to prove
  33 that a file is the same as it was at some given time in the past.</p>
  34
  35 <p>A solution to these problems is to have a trusted third party
  36 "stamp" the document and verify that at some given time the document
  37 looked a given way.  Such
  38 <a href="https://en.wikipedia.org/wiki/Notarius">notarius</a> service
  39 have been around for thousands of years, and its digital equivalent is
  40 called a
  41 <a href="http://en.wikipedia.org/wiki/Trusted_timestamping">trusted
  42 timestamping service</a>.  <a href="http://www.ietf.org/">The Internet
  43 Engineering Task Force</a> standardised how such service could work a
  44 few years ago as <a href="http://tools.ietf.org/html/rfc3161">RFC
  45 3161</a>.  The mechanism is simple.  Create a hash of the file in
  46 question, send it to a trusted third party which add a time stamp to
  47 the hash and sign the result with its private key, and send back the
  48 signed hash + timestamp.  Both email, FTP and HTTP can be used to
  49 request such signature, depending on what is provided by the service
  50 used. Anyone with the document and the signature can then verify that
  51 the document matches the signature by creating their own hash and
  52 checking the signature using the trusted third party public key.
  53 There are several commercial services around providing such
  54 timestamping.  A quick search for
  55 "<a href="https://duckduckgo.com/?q=rfc+3161+service">rfc 3161
  56 service</a>" pointed me to at least
  57 <a href="https://www.digistamp.com/technical/how-a-digital-time-stamp-works/">DigiStamp</a>,
  58 <a href="http://www.quovadisglobal.co.uk/CertificateServices/SigningServices/TimeStamp.aspx">Quo
  59 Vadis</a>,
  60 <a href="https://www.globalsign.com/timestamp-service/">Global Sign</a>
  61 and <a href="http://www.globaltrustfinder.com/TSADefault.aspx">Global
  62 Trust Finder</a>.  The system work as long as the private key of the
  63 trusted third party is not compromised.</p>
  64
  65 <p>But as far as I can tell, there are very few public trusted
  66 timestamp services available for everyone.  I've been looking for one
  67 for a while now. But yesterday I found one over at
  68 <a href="https://www.pki.dfn.de/zeitstempeldienst/">Deutches
  69 Forschungsnetz</a> mentioned in
  70 <a href="http://www.d-mueller.de/blog/dealing-with-trusted-timestamps-in-php-rfc-3161/">a
  71 blog by David Müller</a>.  I then found
  72 <a href="http://www.rz.uni-greifswald.de/support/dfn-pki-zertifikate/zeitstempeldienst.html">a
  73 good recipe on how to use the service</a> over at the University of
  74 Greifswald.</p>
  75
  76 <p><a href="http://www.openssl.org/">The OpenSSL library</a> contain
  77 both server and tools to use and set up your own signing service.  See
  78 the ts(1SSL), tsget(1SSL) manual pages for more details.  The
  79 following shell script demonstrate how to extract a signed timestamp
  80 for any file on the disk in a Debian environment:</p>
  81
  82 <p><blockquote><pre>
  83 #!/bin/sh
  84 set -e
  85 url="http://zeitstempel.dfn.de"
  86 caurl="https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt"
  87 reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq)
  88 resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr)
  89 cafile=chain.txt
  90 if [ ! -f $cafile ] ; then
  91     wget -O $cafile "$caurl"
  92 fi
  93 openssl ts -query -data "$1" -cert | tee "$reqfile" \
  94     | /usr/lib/ssl/misc/tsget -h "$url" -o "$resfile"
  95 openssl ts -reply -in "$resfile" -text 1>&2
  96 openssl ts -verify -data "$1" -in "$resfile" -CAfile "$cafile" 1>&2
  97 base64 < "$resfile"
  98 rm "$reqfile" "$resfile"
  99 </pre></blockquote></p>
 100
 101 <p>The argument to the script is the file to timestamp, and the output
 102 is a base64 encoded version of the signature to STDOUT and details
 103 about the signature to STDERR.  Note that due to
 104 <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742553">a bug
 105 in the tsget script</a>, you might need to modify the included script
 106 and remove the last line.  Or just write your own HTTP uploader using
 107 curl. :) Now you too can prove and verify that files have not been
 108 changed.</p>
 109
 110 <p>But the Internet need more public trusted timestamp services.
 111 Perhaps something for <a href="http://www.uninett.no/">Uninett</a> or
 112 my work place the <a href="http://www.uio.no/">University of Oslo</a>
 113 to set up?</p>
 114 </div>
 115
 116       <div class="tags">Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.</div>
 117
 118
 119     </div>
 120
 121
 122
 123
 124     <div id="sidebar">
 125
 126
 127
 128 <h2>Archive</h2>
 129 <ul>
 130
 131 <li>2014
 132 <ul>
 133
 134 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/01/">January (2)</a></li>
 135
 136 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/02/">February (3)</a></li>
 137
 138 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/03/">March (8)</a></li>
 139
 140 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/04/">April (7)</a></li>
 141
 142 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/05/">May (1)</a></li>
 143
 144 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/06/">June (2)</a></li>
 145
 146 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/07/">July (2)</a></li>
 147
 148 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/08/">August (2)</a></li>
 149
 150 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/09/">September (5)</a></li>
 151
 152 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/10/">October (6)</a></li>
 153
 154 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/11/">November (3)</a></li>
 155
 156 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/12/">December (2)</a></li>
 157
 158 </ul></li>
 159
 160 <li>2013
 161 <ul>
 162
 163 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
 164
 165 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
 166
 167 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
 168
 169 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
 170
 171 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
 172
 173 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
 174
 175 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
 176
 177 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
 178
 179 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/09/">September (5)</a></li>
 180
 181 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/10/">October (7)</a></li>
 182
 183 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/11/">November (9)</a></li>
 184
 185 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/12/">December (3)</a></li>
 186
 187 </ul></li>
 188
 189 <li>2012
 190 <ul>
 191
 192 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
 193
 194 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
 195
 196 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
 197
 198 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
 199
 200 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
 201
 202 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
 203
 204 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
 205
 206 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
 207
 208 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
 209
 210 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
 211
 212 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
 213
 214 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
 215
 216 </ul></li>
 217
 218 <li>2011
 219 <ul>
 220
 221 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
 222
 223 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
 224
 225 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
 226
 227 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
 228
 229 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
 230
 231 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
 232
 233 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
 234
 235 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
 236
 237 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
 238
 239 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
 240
 241 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
 242
 243 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
 244
 245 </ul></li>
 246
 247 <li>2010
 248 <ul>
 249
 250 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 251
 252 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 253
 254 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 255
 256 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 257
 258 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 259
 260 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 261
 262 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 263
 264 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
 265
 266 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
 267
 268 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
 269
 270 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
 271
 272 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
 273
 274 </ul></li>
 275
 276 <li>2009
 277 <ul>
 278
 279 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 280
 281 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 282
 283 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 284
 285 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 286
 287 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 288
 289 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 290
 291 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 292
 293 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 294
 295 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 296
 297 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 298
 299 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 300
 301 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 302
 303 </ul></li>
 304
 305 <li>2008
 306 <ul>
 307
 308 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 309
 310 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 311
 312 </ul></li>
 313
 314 </ul>
 315
 316
 317
 318 <h2>Tags</h2>
 319 <ul>
 320
 321  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
 322
 323  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 324
 325  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 326
 327  <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
 328
 329  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (8)</a></li>
 330
 331  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (15)</a></li>
 332
 333  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
 334
 335  <li><a href="http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (2)</a></li>
 336
 337  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (109)</a></li>
 338
 339  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (151)</a></li>
 340
 341  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (10)</a></li>
 342
 343  <li><a href="http://people.skolelinux.org/pere/blog/tags/dld">dld (15)</a></li>
 344
 345  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (12)</a></li>
 346
 347  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
 348
 349  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (263)</a></li>
 350
 351  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (21)</a></li>
 352
 353  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
 354
 355  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (14)</a></li>
 356
 357  <li><a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (9)</a></li>
 358
 359  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (11)</a></li>
 360
 361  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (41)</a></li>
 362
 363  <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (10)</a></li>
 364
 365  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (19)</a></li>
 366
 367  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (9)</a></li>
 368
 369  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (8)</a></li>
 370
 371  <li><a href="http://people.skolelinux.org/pere/blog/tags/lsdvd">lsdvd (2)</a></li>
 372
 373  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 374
 375  <li><a href="http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (8)</a></li>
 376
 377  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (32)</a></li>
 378
 379  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (251)</a></li>
 380
 381  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (164)</a></li>
 382
 383  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (11)</a></li>
 384
 385  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
 386
 387  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (50)</a></li>
 388
 389  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (76)</a></li>
 390
 391  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
 392
 393  <li><a href="http://people.skolelinux.org/pere/blog/tags/reactos">reactos (1)</a></li>
 394
 395  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
 396
 397  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (3)</a></li>
 398
 399  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (9)</a></li>
 400
 401  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 402
 403  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
 404
 405  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
 406
 407  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (41)</a></li>
 408
 409  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
 410
 411  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (4)</a></li>
 412
 413  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (46)</a></li>
 414
 415  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (3)</a></li>
 416
 417  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (9)</a></li>
 418
 419  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (27)</a></li>
 420
 421  <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (2)</a></li>
 422
 423  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (8)</a></li>
 424
 425  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (46)</a></li>
 426
 427  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
 428
 429  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (34)</a></li>
 430
 431 </ul>
 432
 433
 434     </div>
 435     <p style="text-align: right">
 436  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
 437 </p>
 438
 439   </body>
 440 </html>