How do I securely sign data with a timestamp?

Question

I would like to sign records in a database with a secure timestamp to prove they have not been altered by anyone after that date.

What methods or protocols should I consider? RFC 3161? Most of the websites I've found that claim to provide that service don't really look very reputable to me.

Is it possible to roll your own?

Vicinity

If you're looking for a reputable website, this site is the generally accepted one: itconsult.co.uk/stamper/stampinf.htm, but I don't think it's what you want. – Peipus

Answer 1

If you're looking for a working RFC3161 server then http://time.certum.pl/ has been one that I've known and has been around.

If you're looking for a bigger solution that do not depend on a single secret based timestamping box (basically something that scales well) have a look at http://www.guardtime.com

Technically, a timestamp is a UNIX timestamp :) But the properties you seem to assign to a timestamp are a hash and a "signature" (possibility to verify that the claim that a certain hash existed at a certain time).

Anything that has to do with "trust" is something you can roll your own. The same way you can roll your own CA, the same way you can roll your own standards-based service or invent your own scheme. But convincing other parties to "trust" the thing you've rolled your own might be trickier.

That's why people pay for CA certificates - they are pre-trusted by browser vendors. That's why when you need a solution that others have to trust or if you're obliged to timestamp your data, you need a certified timestamp source.

Sandstone

It seems that you can get a simple free RFC3161 tsr for non-commercial purposes from certum simply by taking your own sha1 sum of your document and making a "GET" request like this: time.certum.pl/?sha1=da39a3ee5e6b4b0d3255bfef95601890afd80709 If you save it as "download.tsr" you can inspect it with the "openssl asn1parse -inform DER < download.tsr" command on Linux, or the openssl "ts" command in 0.9.9. – Loosen

@Loosen - replying to old post - if I use time.certum.pl - where do I get the cert/pubkey of time.certum.pl. i.e. when I get back Time Stamped Data - I would need the public key of TSA to verify it, right - where would I get this? – Undertake

Answer 2

Simple method would be to append the values you want to make sure is not tampered, add a salt to it, and then md5 all of it, and save the md5 hash.

So if you have a table with the columns: Username, Firstname, Lastname, Hash

You do a md5(Username+Firstname+Lastname+"MySuperSecretSalt") and save the value in Hash.

But I must say, it sounds like a weird thing to do.

Centavo