Originating Author: Kurt Stammberger
In traditional digital timestamping systems, networks provide a system time such that data can be time stamped with the year, month, day, hour, minute, and second. This time is then appended to the data in question, and then the entire record is digitally signed to "seal it up". Figure 2 – System Time Stamps shows the relationship between the system clock and the time stamp associated with each piece of signed data.
Presumably the time stamp indicates a particular sequence of events, and implies when the digital signatures were generated. However, note that system-generated time stamps aren't independent of the data generation, or the digital signature generation processes.
The system clock, via the local or wide area network, may be synchronized to a national measurement institute whose clock is calibrated to the international time authority Bureau International des Poids et Mesures (BIPM) located in France. In the United States, the recognized national measurement institutes are the National Institute of Standards and Technology (NIST) and the United States Naval Observatory (USNO). Figure 3 – US National Measurement Institutes shows the relationship of the various NIST timing services.
Timestamps Based on Digital Signatures Can't Be Trusted The problem is, of course, that the system administrator can reset the system clock to any value he or she likes. We can generate timestamps that have nothing to do with the actual "real" time that the data was signed. For example, in the figure below, we've manipulated the system clock so that three pieces of data, signed at different times, have three identical (false) timestamps.
Now we've got three versions of the same data with the same time stamp; and despite the presence of a legitimate digital signature, any "relying party" can no longer have confidence in the data. We have no practical method to distinguish between the three data versions, and no method to even sequence the versions correctly. That's because digital signatures are time-insensitive. In other words, we can't trust timestamps just because they're digitally signed.
In order for us to be able to distinguish between the versions and trust the digital signatures, we need a different approach. We need a mechanism to generate verifiable timestamps that are independent of the digital signature. This is called a trusted time stamp.
Action Item:
Footnotes: