Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)
updated by
- rfc-5816 — ESSCertIDv2 Update for RFC 3161
Extracted elements (30)
No mandatory transport mechanism is defined for TSA messages; email, file-based, TCP socket, and HTTP transports are all specified as optional. This allows the TSP to be used across heterogeneous deployment environments without mandating infrastructure.
The TSA is required to time-stamp only a hash of the datum and must not examine the imprint content beyond checking its length. This design ensures privacy of the underlying data while still providing proof-of-existence.
The TSA must not include any identification of the requesting entity in time-stamp tokens. If TSA needs to authenticate requesters, external mechanisms (CMS encapsulation or TLS) must be used. This separates authentication from the timestamping function.
For email transport, time-stamp messages use MIME types application/timestamp-query (.TSQ) and application/timestamp-reply (.TSR) with base64 Content-Transfer-Encoding. Implementations SHOULD include optional 'name' and 'filename' parameters, with filenames limited to 8+3 characters.
For HTTP transport, time-stamp requests and replies use MIME types application/timestamp-query and application/timestamp-reply respectively, carrying ASN.1 DER-encoded messages directly. The server MUST respond with content type application/timestamp-response or an HTTP error.
If a nonce is included in TimeStampReq, the same nonce value MUST be included in the response; otherwise the response SHALL be rejected. The nonce should be a large random number (e.g., 64-bit integer) generated only once by the client.
If an extension in the request (whether critical or not) is not recognized by the TSA, the server SHALL not issue a token and SHALL return a failure (unacceptedExtension). Unknown extensions are always fatal.
If certReq is present and set to true, the TSA's public key certificate referenced by ESSCertID MUST be provided in the SignedData certificates field. If certReq is missing or false, the certificates field MUST NOT be present in the response.
The serialNumber in TSTInfo MUST be unique for each TimeStampToken issued by a given TSA (TSA name plus serial number uniquely identifies a token). This uniqueness property MUST be preserved even after service interruptions such as crashes.
The time-stamp token MUST NOT contain any signatures other than the signature of the TSA. The certificate identifier (ESSCertID) of the TSA certificate MUST be included as a signerInfo attribute inside a SigningCertificate attribute.
The TSA is REQUIRED to use a trustworthy source of time, include a trustworthy time value in each token, and include a unique integer in each newly generated time-stamp token. These are baseline operational requirements for any compliant TSA.
The TSA MUST sign each time-stamp token using a key generated exclusively for that purpose. The corresponding certificate MUST contain only one instance of the extended key usage extension with id-kp-timeStamping, and this extension MUST be critical.
Upon receiving a TimeStampResp, the requesting entity SHALL verify the status, then verify all TSTInfo fields including that messageImprint matches, the TSA certificate identifier is correct, and timeliness via nonce or local clock comparison. A failing verification SHALL cause the token to be rejected.
Accuracy is an ASN.1 SEQUENCE of optional seconds (INTEGER), millis ([0] INTEGER 1..999), and micros ([1] INTEGER 1..999). Any missing field MUST be taken as zero. Adding/subtracting accuracy to genTime yields upper/lower bounds on token creation time.
MessageImprint is an ASN.1 SEQUENCE containing hashAlgorithm (AlgorithmIdentifier) and hashedMessage (OCTET STRING). The hash value length MUST match the length expected for the identified algorithm (e.g., 20 bytes for SHA-1, 16 bytes for MD5).
PKIFailureInfo is a BIT STRING with defined bit positions: badAlg(0), badRequest(2), badDataFormat(5), timeNotAvailable(14), unacceptedPolicy(15), unacceptedExtension(16), addInfoNotAvailable(17), systemFailure(25). Only these values SHALL be supported.
PKIStatus is an INTEGER with values: granted(0), grantedWithMods(1), rejection(2), waiting(3), revocationWarning(4), revocationNotification(5). Compliant servers SHOULD NOT produce other values; compliant clients MUST generate an error for unrecognized values.
The id-kp-timeStamping KeyPurposeID OID is defined as {iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) timestamping(8)}, used exclusively in TSA signing certificates.
The Signature Time-stamp attribute (id-aa-timeStampToken OID {pkcs-9 smime(16) aa(2) 14}) is defined as an unsigned CMS attribute containing a TimeStampToken whose messageImprint is a hash of the SignerInfo.signature value being time-stamped.
The TCP-based TSA protocol uses IP port 318. The protocol supports polling: a tsaMsg initiates a transaction and the TSA may respond with a pollRep containing a 32-bit polling reference and time-to-check-back (unsigned 32-bit seconds).
If different entities obtain time-stamp tokens on the same data using the same hash algorithm, the generated tokens will contain identical message imprints; an observer with access to those tokens could infer that they refer to the same underlying data.
Replay attacks can be detected using a nonce (RECOMMENDED) or by maintaining a time window during which the requester tracks all hashes sent. A client using only a nonce without a local clock SHOULD bound its acceptable wait time, as a man-in-the-middle can introduce delays.
TSA signing keys MUST be of sufficient length for a long lifetime, but even so have a finite lifetime. Tokens SHOULD be re-timestamped or notarized at a later date to renew trust in the TSA's signature as key sizes become inadequate.
When a TSA certificate is revoked without key compromise, the CRL reasonCode SHALL be set to unspecified(0), affiliationChanged(3), superseded(4), or cessationOfOperation(5); tokens generated before the revocation time remain valid. Without a reasonCode, all tokens signed with that key SHALL be considered invalid.
When the TSA private key is compromised, the certificate SHALL be revoked with reasonCode keyCompromise(1) if the extension is present. All tokens signed with that key cannot be trusted. An audit trail of all generated tokens MAY help discriminate genuine from backdated tokens.
genTime uses GeneralizedTime with syntax YYYYMMDDhhmmss[.s...]Z. The encoding MUST terminate with 'Z', MUST include seconds, trailing fractional zeros MUST be omitted, and midnight is represented as YYYYMMDD000000Z of the following day.
The TCP-based direct message format consists of a 32-bit length (network byte order, counting flag + value octets), an 8-bit flag, and a value field. Flag values: tsaMsg(0x00), pollRep(0x01), pollReq(0x02), negPollRep(0x03), partialMsgRep(0x04), finalMsgRep(0x05), errorMsgRep(0x06).
TimeStampReq is an ASN.1 SEQUENCE containing: version (INTEGER v1), messageImprint (MessageImprint), optional reqPolicy (TSAPolicyId OID), optional nonce (INTEGER), certReq (BOOLEAN DEFAULT FALSE), and optional extensions ([0] IMPLICIT Extensions).
TimeStampResp is an ASN.1 SEQUENCE of PKIStatusInfo and optional TimeStampToken. A TimeStampToken MUST be present when status is 0 (granted) or 1 (grantedWithMods), and MUST NOT be present for any other status value.
TSTInfo is an ASN.1 SEQUENCE containing: version (INTEGER v1), policy (TSAPolicyId), messageImprint (MessageImprint), serialNumber (INTEGER up to 160 bits), genTime (GeneralizedTime), optional accuracy (Accuracy), ordering (BOOLEAN DEFAULT FALSE), optional nonce (INTEGER), optional tsa ([0] GeneralName), optional extensions ([1] IMPLICIT Extensions).