The problem: proving the date
You wrote a document, designed a prototype, drafted a contract. You know when you did it. But how do you prove it to a third party?
The creation date of a file on your computer is not proof. It can be modified, the file can be copied, the file system guarantees nothing. In case of a dispute over the priority of a creation, a patent or a contract, you need independent and verifiable proof.
This is exactly what certified timestamping does.
How RFC 3161 timestamping works
The RFC 3161 standard, published by the IETF, defines a trusted timestamping protocol (TSP = Time-Stamp Protocol). The principle is simple:
- Your document is hashed locally (SHA-256). Only this digital fingerprint is sent, your file never leaves your device.
- The Time-Stamping Authority (TSA) receives this fingerprint, adds the precise date and time, then signs everything with its private key.
- You receive a timestamp token (.tst) that cryptographically binds your document to a specific moment in time.
This token is verifiable by anyone with the authority's certificate. It is tamper-proof: any modification to the document or the date invalidates the signature.
Time sources and trust
The reliability of a timestamp depends on the accuracy of the authority's clock. Sigalion servers use the NTS (Network Time Security) protocol, the secure and authenticated version of NTP, with certified European time sources:
- PTB (Physikalisch-Technische Bundesanstalt) in Germany, reference atomic clock
- Netnod in Sweden, distributed time infrastructure
NTS ensures that time responses cannot be forged or replayed in transit, unlike classic NTP.
eIDAS qualified timestamping
The European eIDAS regulation (910/2014) establishes a legal framework for digital trust services. An eIDAS qualified timestamp benefits from a legal presumption of accuracy of the date and data integrity (Article 41).
The applicable technical standard is ETSI EN 319 421, which defines the requirements for qualified timestamping service providers.
Sigalion offers two levels of timestamping:
- Sigalion TSA, free and unlimited RFC 3161 timestamping, operated on our servers (hosted in France)
- Certigna eIDAS, eIDAS qualified timestamping, issued by Certigna (Tessi Group), a qualified trust service provider listed on the European Trusted List
ASiC-S envelopes: document and proof combined
A timestamp token alone proves that a fingerprint existed at a given moment. But to constitute complete proof, the original document and its token must be combined in a standardized format.
This is the role of the ASiC-S envelope (Associated Signature Container - Simple), defined by the ETSI EN 319 162 standard. It is a ZIP archive containing:
- The original document
- The corresponding timestamp token (.tst)
This envelope combines document and proof in a format that can be verified offline, without contacting the timestamping server again. Verification relies on the authority's certificate chain of trust, as with any X.509 certificate. The format is interoperable with verification tools compliant with ETSI standards.
Integration with Sigalion Vault
Sigalion Vault allows you to encrypt your documents with a password or an X.509 certificate. By choosing the ASiC-S output format, each encrypted file is automatically timestamped and integrated into a standardized envelope.
The result: an .asics file that contains both your encrypted document and the proof of its creation date. You can store it, transmit it, archive it... the proof travels with the document.
When decrypting, Vault displays the timestamp information: date, authority, signature validity, fingerprint match.
Independent verification
Verifying a timestamp token requires no proprietary software. The online service horodatage.sigalion.fr allows you to verify any RFC 3161 token (.tst, .tsr) or any ASiC-S envelope for free, regardless of the original provider. eIDAS qualified timestamps are also verifiable by European validation tools compliant with ETSI standards.
Verification checks three elements:
- The cryptographic signature of the token (chain of trust)
- The match between the token's fingerprint and that of the original document (if provided)
- The integrity of the ASiC-S envelope (if applicable)
In practice
Timestamping is for anyone who needs to prove a date:
- Creators and inventors: proof of prior existence for designs, models, concepts, source code
- Legal professionals: certified date for contracts, formal notices, records
- Researchers: priority of results, digital laboratory notebooks
- Businesses: regulatory compliance, evidential archiving, traceability
Timestamping services are available at horodatage.sigalion.fr : token creation, verification and ASiC-S envelopes.