OBSCURA OS
Settings

Check a trusted timestamp

Drop a .tsr or .tst and the file it is for. See when it was stamped, by which authority, and whether the signature and certificate hold up. The file is hashed here and never uploaded.

The timestamp and the file

Drop the timestamp (.tsr or .tst) and the file it is for. A request (.tsq) or the authority's certificate can go in too.

What a trusted timestamp is

A trusted timestamp proves a file existed at a certain moment without anyone seeing the file. Its hash is sent to a timestamping authority, which signs a statement of that hash and the time, and sends it back as a .tsr file. The format is RFC 3161. It is how lab notebooks, source code, evidence files, invoices and signed documents are dated so that the date holds up later, and it is what the timestamp on a long-term PDF or e-mail signature is made of.

What is checked

  • That it is for this file. The file is hashed in your browser and compared with the hash the timestamp records. A hash pasted instead works the same way.
  • That the authority signed it. The signature is checked against the authority's certificate with your browser's own cryptography, and so is the certificate the timestamp names by hash, so one cannot be swapped for another.
  • That the certificate is fit for it. RFC 3161 wants a certificate issued for timestamping and nothing else, with that marked critical, and valid at the moment it stamped.
  • That it answers the request. With the .tsq that was sent, the hash, the nonce and the policy are matched, which shows the response was issued for that request and not replayed.
  • Where the authority's certificate comes from. Each certificate included is checked against the one above it, up to the root, which is named with its fingerprint.

What it does not do

It does not decide whether the authority is one you trust, which depends on the roots your own systems hold. It does not check revocation, which would mean asking the certificate authority over the network. It does not read RFC 5544 timestamped-data files (.tsd), only the .tsr and .tst that RFC 3161 defines. Nothing is uploaded: the file is hashed in this tab and only the comparison is shown.