5 ms·

Timestamping documents via their hash

lucb1e 6y ago
I know there exist uses for timestamping, but I don't know how often this actually comes up in practice. Have you ever gone to a notary to timestamp something before Bitcoin came along? The options are posting it to something like Twitter, including a newspaper headline in your cryptographic signature if you want to prove an after date rather than a before date, or indeed a notary. While I agree blockchain is a more elegant solution, it's the only solution I see in this thread so far where blockchain has an extra advantage, and I'm curious whether we need to have an extra country on this planet in terms of power consumption just to avoid going to a notary on occasion.
- detaro 6y ago
  The interesting cases are much more companies wanting to timestamp dozens to thousands of documents or events per day. But there the "notary" solution is a common one - many companies offer timestamping as a service with an API, and in most cases you can probably find one all involved parties can trust (e.g. some CAs run such services)
  - lucb1e 6y ago
    What are these companies timestamping though? That's what I meant to ask. I know there is a need for the service or there wouldn't be parties offering it, I just don't really know specific examples of uses for it because I never came across any myself. It appears to be a rare need to me, but you make it sound like some companies would want to do this so much that it's worth automating, but then I still don't know what those companies do or want timestamped by a third party (be that a notary or a blockchain). The two Wikipedia articles I found on timestamping aren't really about timestamping of this kind. (https://en.wikipedia.org/wiki/Timestamp https://en.wikipedia.org/wiki/Timestamp and https://en.wikipedia.org/wiki/Timestamping_(computing) https://en.wikipedia.org/wiki/Timestamping_(computing))
    - littlecranky67 6y ago
      Look for RFC3161, its a standardized timestamping service over the network. You send arbitrarily binary content (subject to size limitations of course) via HTTP POST to an endpoint of the provider, and the resulting HTTP response is a signed data structure containing a cryptgraphic hash of the response together with the timestamp. When public/private crypto is used by the provider, all you need to verify the signed response for authenticity is the public key of the provider.
- jkepler 6y ago
  I used opentimestamps.org to timestamp my last apartment lease after signing and before emailing it to an out-of-country landlord who I'd never met; he then signed it and time-stamped his copy before sending me a copy. That way, in case if a dispute, we both had time-stamped proof neither party had changed any lease terms before signing--- as anyone (he, I, or a court) could compare the wording and verify he didn't change what I signed before he signed. His local agent in my city didn't have signing authority for him.
- littlecranky67 6y ago
  There exists a dedicated timestamping RFC: RFC3161. And yes, there is a vast number of publicly available (for a fee) service providers that offer this as a service. Even before blockchain, these were in use. In Germany, there was a law that would require you to store you bookkeeping transactions only with those timestamps applied to avoid retroactive tampering. I.e. if you had received an Invoice as a PDF, you were required to timestamp it in a "secure, tamper proof manner" to be legally compliant. I personally used the free RFC3161 service provided and run for free by DFN ("Deutsches ForschungsNetzwerk", an organization of universities and higher education institutions). The law was abandoned, and it is okay now to store digital invoices without timestamps. If I would have been audited, I am not sure that those timestamps would qualify to met the requirements by law, but I took my chances. To this day there are still various providers of RFC3161 timestamps, and interfacing is rather easy (you send an HTTP post request by cURL and receive a signed fingerprint by the trusted party).

I know there exist uses for timestamping, but I don't know how often this actually comes up in practice. Have you ever gone to a notary to timestamp something before Bitcoin came along? The options are posting it to something like Twitter, including a newspaper headline in your cryptographic signature if you want to prove an after date rather than a before date, or indeed a notary. While I agree blockchain is a more elegant solution, it's the only solution I see in this thread so far where blockchain has an extra advantage, and I'm curious whether we need to have an extra country on this planet in terms of power consumption just to avoid going to a notary on occasion.

detaro 6y ago
The interesting cases are much more companies wanting to timestamp dozens to thousands of documents or events per day. But there the "notary" solution is a common one - many companies offer timestamping as a service with an API, and in most cases you can probably find one all involved parties can trust (e.g. some CAs run such services)
- lucb1e 6y ago
  What are these companies timestamping though? That's what I meant to ask. I know there is a need for the service or there wouldn't be parties offering it, I just don't really know specific examples of uses for it because I never came across any myself. It appears to be a rare need to me, but you make it sound like some companies would want to do this so much that it's worth automating, but then I still don't know what those companies do or want timestamped by a third party (be that a notary or a blockchain). The two Wikipedia articles I found on timestamping aren't really about timestamping of this kind. (https://en.wikipedia.org/wiki/Timestamp https://en.wikipedia.org/wiki/Timestamp and https://en.wikipedia.org/wiki/Timestamping_(computing) https://en.wikipedia.org/wiki/Timestamping_(computing))
  - littlecranky67 6y ago
    Look for RFC3161, its a standardized timestamping service over the network. You send arbitrarily binary content (subject to size limitations of course) via HTTP POST to an endpoint of the provider, and the resulting HTTP response is a signed data structure containing a cryptgraphic hash of the response together with the timestamp. When public/private crypto is used by the provider, all you need to verify the signed response for authenticity is the public key of the provider.
jkepler 6y ago
I used opentimestamps.org to timestamp my last apartment lease after signing and before emailing it to an out-of-country landlord who I'd never met; he then signed it and time-stamped his copy before sending me a copy. That way, in case if a dispute, we both had time-stamped proof neither party had changed any lease terms before signing--- as anyone (he, I, or a court) could compare the wording and verify he didn't change what I signed before he signed. His local agent in my city didn't have signing authority for him.
littlecranky67 6y ago
There exists a dedicated timestamping RFC: RFC3161. And yes, there is a vast number of publicly available (for a fee) service providers that offer this as a service. Even before blockchain, these were in use. In Germany, there was a law that would require you to store you bookkeeping transactions only with those timestamps applied to avoid retroactive tampering. I.e. if you had received an Invoice as a PDF, you were required to timestamp it in a "secure, tamper proof manner" to be legally compliant. I personally used the free RFC3161 service provided and run for free by DFN ("Deutsches ForschungsNetzwerk", an organization of universities and higher education institutions). The law was abandoned, and it is okay now to store digital invoices without timestamps. If I would have been audited, I am not sure that those timestamps would qualify to met the requirements by law, but I took my chances. To this day there are still various providers of RFC3161 timestamps, and interfacing is rather easy (you send an HTTP post request by cURL and receive a signed fingerprint by the trusted party).