Timestamping Authority (TSA)

The TSA does not store your original document. Instead, it generates a timestamp token that cryptographically binds the hash of your data to the current time. This token is digitally signed by the TSA's private key, creating a mathematically verifiable link between the data's fingerprint and the attested time. Any change to the original data, even a single bit, will produce a completely different hash, instantly invalidating the timestamp.

A TSA must synchronize its internal clock with a trusted, auditable time source to ensure accuracy. This is typically achieved through:

• UTC Traceability: The TSA's clock is calibrated to Coordinated Universal Time (UTC) via a trusted source like a national atomic clock or a GPS signal.
• Defined Accuracy: The TSA's policy explicitly states the degree of accuracy and precision of its timestamps.
• Leap Second Handling: Robust TSAs have a documented policy for handling leap seconds to maintain a continuous, unambiguous timeline.

A valid timestamp token provides non-repudiation of existence. The entity that requested the timestamp cannot later deny that the data existed at the attested time. This is because the token is a signed assertion from a trusted third party, and the requesting entity possesses the data that matches the hash inside the token. This property is foundational for legal and regulatory compliance.

Digital signatures and hash algorithms have a limited cryptanalytic lifespan. A robust TSA supports long-term validation to ensure timestamps remain verifiable for decades:

• Periodic Timestamping: Before the algorithms used in a timestamp token become weak, the token itself is re-timestamped with stronger algorithms, creating a chain of trust.
• Verifiable Chain: This creates a cryptographically unbroken chain of evidence from the original data to a current, strong timestamp, proving the data has existed continuously since the original attestation.

The most widely adopted standard for timestamping is IETF RFC 3161, which defines the protocol for requesting and receiving timestamp tokens. Key components include:

• Time-Stamp Protocol (TSP): Uses HTTP or TCP for communication between the requesting client and the TSA.
• ASN.1 Encoding: Timestamp requests and responses are encoded using Abstract Syntax Notation One (ASN.1), a standard for serializing complex data structures.
• Interoperability: Adherence to this standard ensures that a timestamp generated by one vendor's TSA can be verified by another vendor's software.

A trustworthy TSA is subject to regular, independent audits to verify its operational integrity. Auditors examine:

• Key Management: The security of the TSA's private signing key, including its generation, storage, and lifecycle within a Hardware Security Module (HSM).
• Time Synchronization: The accuracy and traceability of the TSA's clock source.
• Operational Logs: The immutability and completeness of all operational records.
• Policy Adherence: Compliance with the TSA's own published Certificate Practice Statement (CPS).