SHA1 is generally recognized as being just fine for most business purposes, even after the Chinese attack. When people talk about the security of something it'

SHA1 is generally recognized as being just fine for most business purposes, even after the Chinese attack. When people talk about the security of something it's really important to understand the nature of the attack. Even if you could theoretically generate a random looking chunk of data which could return the same digest, that in itself does not make the timecert any less secure. This is more an issue in traditional digital signature applications. I also think I'd dispute the idea that they aren't worth much in a patent dispute. Academic Journals and Patent Applications work as a trusted third party in the same way as TimeCert does. An online Lab Journal service would be an excellent idea.